FIX CVE Need permission to be able to develop modules

Dolibarr · Jan 31, 2020 · 1c24bcc · 1c24bcc
1 parent d60ce8a
commit 1c24bcc
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/htdocs/core/modules/modModuleBuilder.class.php b/htdocs/core/modules/modModuleBuilder.class.php
@@ -45,6 +45,7 @@ public function __construct($db)
 		// Family can be 'crm','financial','hr','projects','products','ecm','technic','other'
 		// It is used to group modules in module setup page
         $this->family = "technic";
+        $this->module_position = '90';
         // Module label (no space allowed), used if translation string 'ModuleXXXName' not found (where XXX is value of numeric property 'numero' of module)
         $this->name = preg_replace('/^mod/i', '', get_class($this));
         $this->description = "A RAD (Rapid Application Development) tool to help developers to build their own module.";
@@ -82,6 +83,21 @@ public function __construct($db)
         //------
         $this->boxes = array();
 
+        // Permissions
+        //------------
+        $this->rights = array();		// Permission array used by this module
+        $this->rights_class = 'modulebuilder';
+
+        $r=0;
+
+        $r++;
+        $this->rights[$r][0] = 3301;
+        $this->rights[$r][1] = 'Generate new modules';
+        $this->rights[$r][2] = 'a';
+        $this->rights[$r][3] = 0;
+        $this->rights[$r][4] = 'run';
+
+
         // Main menu entries
         //------------------
         $this->menu = array();

diff --git a/htdocs/modulebuilder/index.php b/htdocs/modulebuilder/index.php
@@ -90,6 +90,9 @@
 	$newmask = '0664';
 }
 
+$result = restrictedArea($user, 'modulebuilder', null);
+
+
 
 /*
  * Actions