Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
FIX user without permission can set ticket subject
  • Loading branch information
eldy committed Sep 18, 2021
1 parent 052511d commit facd6ab
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion htdocs/ticket/card.php
Expand Up @@ -492,7 +492,7 @@
}
}

if ($action == 'setsubject') {
if ($action == 'setsubject' && $user->rights->ticket->write) {
if ($object->fetch(GETPOST('id', 'int'))) {
if ($action == 'setsubject') {
$object->subject = GETPOST('subject', 'alphanohtml');
Expand Down

0 comments on commit facd6ab

Please sign in to comment.