FIX permission to delete a draft purchase order

Dolibarr · Jul 4, 2019 · 657a3ae · 657a3ae
1 parent 69e0353
commit 657a3ae
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 4 deletions.
diff --git a/htdocs/fourn/commande/card.php b/htdocs/fourn/commande/card.php
@@ -2516,7 +2516,7 @@
 			}
 
 			// Delete
-			if ($user->rights->fournisseur->commande->supprimer)
+			if (! empty($user->rights->fournisseur->commande->supprimer) || ($object->statut == CommandeFournisseur::STATUS_DRAFT && ! empty($user->rights->fournisseur->commande->creer)))
 			{
 				print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans("Delete").'</a>';
 			}

diff --git a/htdocs/modulebuilder/template/myobject_card.php b/htdocs/modulebuilder/template/myobject_card.php
@@ -434,7 +434,7 @@ function init_myfunc()
             print '<a class="butAction" href="' . $_SERVER["PHP_SELF"] . '?id=' . $object->id . '&action=presend&mode=init#formmailbeforetitle">' . $langs->trans('SendMail') . '</a>'."\n";
 
             // Modify
-    		if ($user->rights->mymodule->write)
+            if (! empty($user->rights->mymodule->write))
     		{
     			print '<a class="butAction" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=edit">'.$langs->trans("Modify").'</a>'."\n";
     		}
@@ -444,7 +444,7 @@ function init_myfunc()
     		}
 
     		// Clone
-    		if ($user->rights->mymodule->write)
+    		if (! empty($user->rights->mymodule->write))
     		{
     			print '<div class="inline-block divButAction"><a class="butAction" href="' . $_SERVER['PHP_SELF'] . '?id=' . $object->id . '&amp;socid=' . $object->socid . '&amp;action=clone&amp;object=order">' . $langs->trans("ToClone") . '</a></div>';
     		}
@@ -463,7 +463,8 @@ function init_myfunc()
     		}
     		*/
 
-    		if ($user->rights->mymodule->delete)
+    		// Delete (need delete permission, or if draft, just need create/modify permission)
+    		if (! empty($user->rights->mymodule->delete) || (! empty($object->fields['status']) && $object->status == $object::STATUS_DRAFT && ! empty($user->rights->mymodule->write)))
     		{
     			print '<a class="butActionDelete" href="'.$_SERVER["PHP_SELF"].'?id='.$object->id.'&amp;action=delete">'.$langs->trans('Delete').'</a>'."\n";
     		}