External users cannot see projects

[jriboux]

Bug

External users cannot see or access projects when assigned as contact.

Environment

• Version: [9.0.1]
• PHP: [7.0]

Expected and actual behavior

External users should see projects they are assigned as contact

Steps to reproduce the behavior

• Create a contact
• Create an external user for this contact
• Create a project
• Assign contact on project

Fix ?

It seems to be an error in htdocs/projet/class/project.class.php lines 1239 & 1247.
$sql.= " AND ec.fk_socpeople = ".$user->id.")";
Maybe use $user->contactid instead ?
fk_socpeople seems to be sometime a user id and sometime a contact id, this can lead to security issues.

The line 701 in htdocs/projet/list.php prevents the project list to be shown.

[eldy]

By definition, an external user can see only elements of its thirdparties.
Does the project you try to read have a thirdparty that is the thirdparty of the external user ?

[ukb-33]

Got same problem here with a quite fresh 10.0.0.4 install.
Tested a couple of differents config in terms of rights, and found that the first "Lire les projets et tâches (partagés ou dont vous n'êtes pas contact)" seems to be not enough event in these situation:

• external user UA, linked to company CA
• project P, created by Admin, for third party CA
• UA is mentionned as responsible for project P and associated tasks.

When UA connects, she can't see project where she is named as contact.

[ukb-33]

Environment information are mentionned in #12798

[ksar-ksar]

Have you tested with latest dolibarr version ?

[ksar-ksar]

Hello,

You can re-open the issue if it is still a BUG

[Dominatorr007]

yes in version 13.4 this bug still persists please fix

[wolfcreative]

14.0.5, the bug is still present
@eldy, can you tell me how to fix this?

[rycks]

Here is the race condition @eldy :

Then in this case we can't filter only on "internal" ctc.source ...

[denisb79]

Has someone solved the issue?
I have version 15 installed and our external users can't see the progress of their projects.
Thank you so much

[Xenion1987]

15.0.3 still not solved