FIX #7806

Dolibarr · Nov 25, 2017 · 4cbcf51 · 4cbcf51
1 parent 38c770f
commit 4cbcf51
Showing 1 changed file with 20 additions and 0 deletions.
diff --git a/htdocs/user/class/api_users.class.php b/htdocs/user/class/api_users.class.php
@@ -286,6 +286,7 @@ function delete($id) {
 	 * @return    array    Array of cleaned object properties
 	 */
 	function _cleanObjectDatas($object) {
+		global $conf;
 
 	    $object = parent::_cleanObjectDatas($object);
 
@@ -298,10 +299,16 @@ function _cleanObjectDatas($object) {
 	    unset($object->total_localtax1);
 	    unset($object->total_localtax2);
 	    unset($object->total_ttc);
+	    unset($object->libelle_incoterms);
+	    unset($object->location_incoterms);
 
 	    unset($object->fk_delivery_address);
 	    unset($object->fk_incoterms);
 	    unset($object->all_permissions_are_loaded);
+	    unset($object->shipping_method_id);
+	    unset($object->nb_rights);
+	    unset($object->search_sid);
+	    unset($object->ldap_sid);
 
 	    // List of properties never returned by API, whatever are permissions
 	    unset($object->pass);
@@ -310,6 +317,19 @@ function _cleanObjectDatas($object) {
 	    unset($object->pass_temp);
 	    unset($object->api_key);
 	    unset($object->clicktodial_password);
+	    unset($object->openid);
+
+
+	    $canreadsalary = ((! empty($conf->salaries->enabled) && ! empty(DolibarrApiAccess::$user->rights->salaries->read))
+	    	|| (! empty($conf->hrm->enabled) && ! empty(DolibarrApiAccess::$user->rights->hrm->employee->read)));
+
+		if (! $canreadsalary)
+		{
+			unset($object->salary);
+			unset($object->salaryextra);
+			unset($object->thm);
+			unset($object->tjm);
+		}
 
 	    return $object;
 	}