vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix add guard on salary field permission when module salary is -

Browse source 
reported by vulncheck
This commit is contained in:
Laurent Destailleur 2026-08-18 12:45:00 +02:00
parent c100564d05
commit c85d0e8407
1 changed files with 19 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
htdocs/user/class/api_users.class.php
View file

@ -373,7 +373,7 @@ class Users extends DolibarrApi
//assign field values
foreach ($request_data as $field => $value) {
if (in_array($field, array('pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key'))) {
if (in_array($field, array('pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key', 'openid'))) {
// This properties can't be set/modified with API
throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs");
}
@ -384,6 +384,14 @@ class Users extends DolibarrApi
}
}
*/
$canreadsalary = ((isModEnabled('salaries') && DolibarrApiAccess::$user->hasRight('salaries', 'read')) || !isModEnabled('salaries'));
if (!$canreadsalary) {
if (in_array($field, array('salary', 'salaryextra', 'thm', 'tjm'))) {
// This properties can't be set/modified with API
throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs with permission on salaries");
}
}
if ($field === 'caller') {
// Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
$this->useraccount->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
@ -455,10 +463,19 @@ class Users extends DolibarrApi
}
foreach ($request_data as $field => $value) {
if (in_array($field, array('pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key'))) {
if (in_array($field, array('pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key', 'openid'))) {
// This properties can't be set/modified with API
throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs");
}
$canreadsalary = ((isModEnabled('salaries') && DolibarrApiAccess::$user->hasRight('salaries', 'read')) || !isModEnabled('salaries'));
if (!$canreadsalary) {
if (in_array($field, array('salary', 'salaryextra', 'thm', 'tjm'))) {
// This properties can't be set/modified with API
throw new RestException(405, 'The property '.$field." can't be set/modified using the APIs with permission on salaries");
}
}
if ($field == 'id') {
continue;
}