Fix #8058

Dolibarr · Jan 19, 2018 · a58a3f8 · a58a3f8
1 parent d967527
commit a58a3f8
Showing 1 changed file with 29 additions and 16 deletions.
diff --git a/htdocs/product/stock/product.php b/htdocs/product/stock/product.php
@@ -111,7 +111,8 @@
 $reshook=$hookmanager->executeHooks('doActions',$parameters,$object,$action);    // Note that $action and $object may have been modified by some hooks
 if ($reshook < 0) setEventMessages($hookmanager->error, $hookmanager->errors, 'errors');
 
-if ($action == 'addlimitstockwarehouse') {
+if ($action == 'addlimitstockwarehouse' AND !empty($user->rights->produit->creer))
+{
 
 	$seuil_stock_alerte = GETPOST('seuil_stock_alerte');
 	$desiredstock = GETPOST('desiredstock');
@@ -154,7 +155,7 @@
 
 }
 
-if($action == 'delete_productstockwarehouse')
+if($action == 'delete_productstockwarehouse' AND !empty($user->rights->produit->creer))
 {
 
 	$pse = new ProductStockEntrepot($db);
@@ -166,7 +167,7 @@
 }
 
 // Set stock limit
-if ($action == 'setseuil_stock_alerte')
+if ($action == 'setseuil_stock_alerte' AND !empty($user->rights->produit->creer))
 {
     $object = new Product($db);
     $result=$object->fetch($id);
@@ -180,7 +181,7 @@
 }
 
 // Set desired stock
-if ($action == 'setdesiredstock')
+if ($action == 'setdesiredstock' AND !empty($user->rights->produit->creer))
 {
     $object = new Product($db);
     $result=$object->fetch($id);
@@ -947,16 +948,24 @@
 	print '<br><br>';
 	print_titre($langs->trans('AddNewProductStockWarehouse'));
 
-	print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
-	print '<input type="hidden" name="action" value="addlimitstockwarehouse">';
-	print '<input type="hidden" name="id" value="'.GETPOST('id').'">';
+	if (!empty($user->rights->produit->creer)){
+		print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
+		print '<input type="hidden" name="action" value="addlimitstockwarehouse">';
+		print '<input type="hidden" name="id" value="'.GETPOST('id').'">';
+	}
 	print '<table class="noborder" width="100%">';
-
-	print '<tr class="liste_titre"><td width="40%" colspan="4">'.$formproduct->selectWarehouses('', 'fk_entrepot').'</td>';
-	print '<td align="right"><input name="seuil_stock_alerte" type="text" placeholder="'.$langs->trans("StockLimit").'" /></td>';
-	print '<td align="right"><input name="desiredstock" type="text" placeholder="'.$langs->trans("DesiredStock").'" /></td>';
-	print '<td align="right"><input type="submit" value="'.$langs->trans('Save').'" class="button" /></td>';
-	print '</tr>';
+	if (!empty($user->rights->produit->creer)){
+		print '<tr class="liste_titre"><td width="40%">'.$formproduct->selectWarehouses('', 'fk_entrepot').'</td>';
+		print '<td align="right"><input name="seuil_stock_alerte" type="text" placeholder="'.$langs->trans("StockLimit").'" /></td>';
+		print '<td align="right"><input name="desiredstock" type="text" placeholder="'.$langs->trans("DesiredStock").'" /></td>';
+		print '<td align="right"><input type="submit" value="'.$langs->trans('Save').'" class="button" /></td>';
+		print '</tr>';
+	}else{
+		print '<tr class="liste_titre"><td width="40%">'.$langs->trans("Warehouse").'</td>';
+		print '<td align="right">'.$langs->trans("StockLimit").'</td>';
+		print '<td align="right">'.$langs->trans("DesiredStock").'</td>';
+		print '</tr>';
+	}
 
 	$pse = new ProductStockEntrepot($db);
 	$lines = $pse->fetchAll(GETPOST('id'));
@@ -968,17 +977,21 @@
 		{
 			$ent = new Entrepot($db);
 			$ent->fetch($line['fk_entrepot']);
-			print '<tr class="oddeven"><td width="40%" colspan="4">'.$ent->getNomUrl(3).'</td>';
+			print '<tr class="oddeven"><td width="40%">'.$ent->getNomUrl(3).'</td>';
 			print '<td align="right">'.$line['seuil_stock_alerte'].'</td>';
 			print '<td align="right">'.$line['desiredstock'].'</td>';
-			print '<td align="right"><a href="?id='.GETPOST('id').'&fk_productstockwarehouse='.$line['id'].'&action=delete_productstockwarehouse">'.img_delete().'</a></td>';
+			if (!empty($user->rights->produit->creer)){
+				print '<td align="right"><a href="?id='.GETPOST('id').'&fk_productstockwarehouse='.$line['id'].'&action=delete_productstockwarehouse">'.img_delete().'</a></td>';
+			}
 			print '</tr>';
 		}
 	}
 
 	print "</table>";
 
-	print '</form>';
+	if (!empty($user->rights->produit->creer)){ 
+	    print '</form>'; 
+	}
 }
 
 llxFooter();