diff --git a/include/ajax/ajax_accounting.php b/include/ajax/ajax_accounting.php
index da49f956a..f2b26e402 100644
--- a/include/ajax/ajax_accounting.php
+++ b/include/ajax/ajax_accounting.php
@@ -37,7 +37,7 @@ try {
     echo $e->getMessage();
     return;
 }
-if  ( $g_user->check_module("C0PCMN") == 0) die();
+
 
 
 $obj=new Acc_Plan_SQL($cn);
@@ -48,6 +48,13 @@ $manage_table=new Acc_Plan_MTable($obj);
 $manage_table->add_json_param("op","accounting");
 $manage_table->set_object_name($ctl_id);
 $manage_table->set_callback("ajax_misc.php");
+if  ( $g_user->check_module("C0PCMN") == 0) 
+{
+    header('Content-type: text/xml; charset=UTF-8');
+    echo Manage_Table_SQL::ajax_error(_('Accès non autorisé'))->saveXML();
+    record_log("C0PCMN security ");
+    return;
+}
 if ($action=="input")
 {
     header('Content-type: text/xml; charset=UTF-8');
diff --git a/include/ajax/ajax_anc_plan.php b/include/ajax/ajax_anc_plan.php
index 288ebf469..09dfb3836 100644
--- a/include/ajax/ajax_anc_plan.php
+++ b/include/ajax/ajax_anc_plan.php
@@ -27,7 +27,7 @@ if (!defined('ALLOWED'))
     die('Appel direct ne sont pas permis');
 
 
-if ( $g_user->check_module("PLANANC ") ) die("forbidden");
+
 
 $input = $http->request("input");
 $action = $http->request("ieaction", "string", "display");
@@ -39,6 +39,10 @@ $answer->set_callback("ajax_misc.php");
 $answer->add_json_param("action","anc_updatedescription");
 $answer->add_json_param("op","anc_updatedescription");
 $answer->add_json_param("id",$pa_id);
+if ( $g_user->check_module("PLANANC") == 0) {
+    record_log("PLANANC security ");
+    return;
+}
     
 $input=$answer->get_input();
 if ($action=="display") {
diff --git a/include/ajax/ajax_cfgaction.php b/include/ajax/ajax_cfgaction.php
index 918779a2f..21cbb3683 100644
--- a/include/ajax/ajax_cfgaction.php
+++ b/include/ajax/ajax_cfgaction.php
@@ -21,16 +21,6 @@
 
 if (!defined('ALLOWED'))
     die('Appel direct ne sont pas permis');
-
-// check right
-if ($g_user->check_action(PARCATDOC)==0)
-{
-
-    record_log("cfgaction01 security ");
-    return;
-}
-
-
 $http=new HttpInput();
 
 
@@ -47,17 +37,28 @@ try
 }
 catch (Exception $ex)
 {
-    echo $e->getMessage();
+    record_log($e);
     return;
 }
 
+
+
+
+
 $doc_type=new Document_type_SQL($cn,$p_id);
 $action_document_type=new Action_Document_Type_MTable($doc_type);
 
 $action_document_type->set_callback("ajax_misc.php");
 $action_document_type->add_json_param("op", "cfgaction");
 $action_document_type->set_object_name($ctl_id);
-
+// check right
+if ( $g_user->check_module("C0ACT")==0)
+{
+    header('Content-type: text/xml; charset=UTF-8');
+    echo $action_document_type->ajax_error(_('Accès non autorisé'))->saveXML();
+    record_log("cfgaction01 security ");
+    return;
+}
 
 
 if ($action=="input")
diff --git a/include/ajax/ajax_company.php b/include/ajax/ajax_company.php
index 6830d1617..f163a9f0b 100644
--- a/include/ajax/ajax_company.php
+++ b/include/ajax/ajax_company.php
@@ -28,7 +28,7 @@ if (!defined('ALLOWED'))
  */
 global $g_user;
 
-if ($g_user->check_module("COMPANY")==0) die();
+
 
 
 $http=new HttpInput();
@@ -44,6 +44,14 @@ try {
 }
 $parameter_extra =Parameter_Extra_MTable::build($p_id);
 $parameter_extra->set_object_name($ctl_id);
+if ($g_user->check_module("COMPANY")==0) 
+{
+    header('Content-type: text/xml; charset=UTF-8');
+    echo Manage_Table_SQL::ajax_error(_('Accès non autorisé'))->saveXML();
+    record_log("COMPANY security ");
+    return;
+
+}
 if ($action=="input")
 {
     $parameter_extra->send_header();
diff --git a/include/ajax/ajax_forecast_category.php b/include/ajax/ajax_forecast_category.php
index a4d355b3b..f326eb01f 100644
--- a/include/ajax/ajax_forecast_category.php
+++ b/include/ajax/ajax_forecast_category.php
@@ -26,7 +26,7 @@ if (!defined('ALLOWED'))     die('Appel direct ne sont pas permis');
 
 global $g_user;
 
-if ($g_user->check_module("FORECAST")==0) die();
+
 
 $http=new HttpInput();
 try {
@@ -41,6 +41,15 @@ try {
 }
 $forecast_category =  Forecast_Category_MTable::build($p_id);
 $forecast_category->set_object_name($ctl_id);
+
+if ($g_user->check_module("FORECAST")==0) 
+{
+    header('Content-type: text/xml; charset=UTF-8');
+    echo Manage_Table_SQL::ajax_error(_('Accès non autorisé'))->saveXML();
+    record_log("security FORECAST");
+    return;
+}
+
 if ($action=="input")
 {
     $forecast_category->send_header();
diff --git a/include/ajax/ajax_other_tax.php b/include/ajax/ajax_other_tax.php
index 141644f0e..1c28c1907 100644
--- a/include/ajax/ajax_other_tax.php
+++ b/include/ajax/ajax_other_tax.php
@@ -21,7 +21,12 @@ global $g_user;
 if (!defined('ALLOWED'))
     die('Appel direct ne sont pas permis');
 
-if  ( $g_user->check_module("OTAX") == 0) die("");
+if  ( $g_user->check_module("OTAX") == 0) {
+    header('Content-type: text/xml; charset=UTF-8');
+    echo Manage_Table_SQL::ajax_error(_('Accès non autorisé'))->saveXML();
+    record_log("security OTAX");
+    return;
+}
 
 try {
     $table=$http->request('table');
diff --git a/include/ajax/ajax_save_predf_op.php b/include/ajax/ajax_save_predf_op.php
index 7a23d373d..fda349b6b 100644
--- a/include/ajax/ajax_save_predf_op.php
+++ b/include/ajax/ajax_save_predf_op.php
@@ -39,7 +39,13 @@ try {
     echo $e->getMessage();
     return;
 }
-if  ( $g_user->check_module("PREDOP") == 0) die();
+if  ( $g_user->check_module("PREDOP") == 0)
+{
+    header('Content-type: text/xml; charset=UTF-8');
+    echo Manage_Table_SQL::ajax_error(_('Accès non autorisé'),)->saveXML();
+    record_log("security PREDOP");
+    return;
+}
 
 $prd_op=new Op_Predef_SQL($cn);
 $prd_op->set_pk_value($p_id);
diff --git a/include/ajax/ajax_user_security.php b/include/ajax/ajax_user_security.php
index 4a0636dd1..ba38ab99f 100644
--- a/include/ajax/ajax_user_security.php
+++ b/include/ajax/ajax_user_security.php
@@ -32,7 +32,7 @@ if (!defined('ALLOWED'))
  global $g_user;
  if ($g_user->check_module("C0SEC") == 0) {
      record_log("UNAUTHORIZED ACCESS");
-     return;
+    return;
 }
 
 $n_dossier_id=Dossier::id();
diff --git a/include/lib/manage_table_sql.class.php b/include/lib/manage_table_sql.class.php
index 8f411bcc5..6d09789b1 100644
--- a/include/lib/manage_table_sql.class.php
+++ b/include/lib/manage_table_sql.class.php
@@ -1586,4 +1586,49 @@ function check()
         print_r($p_row);
         echo '</a></td>';
     }
+    /**
+     * @brief returns an XML object for  error message as unauthorized access.
+     * Called by ManageTable->input.
+     * @code
+// Example if the user cannot access , displays an
+// an error message and returns 
+if ( $g_user->check_action(PARCATDOC)==0)
+{
+    header('Content-type: text/xml; charset=UTF-8');
+    echo $action_document_type->ajax_error(_('Accès non autorisé'))->saveXML();
+    record_log("cfgaction01 security ");
+    return;
+}
+     * @endcode
+     * @param $p_message (string) message to display
+     * @return DOMDocument
+     */
+    static function ajax_error($p_message): DOMDocument {
+        $xml = new DOMDocument("1.0", "UTF-8");
+        $s1=$xml->createElement("status", 'NOK');
+        $dialog_box="dtr";
+        
+        $str = HtmlInput::title_box(_("ERROR"), $dialog_box, "close", "", "y", "y");
+        $str .= '<h2 class="error">' . h(_($p_message)) . '</h2>';
+        $str .= '<ul class="aligned-block">';
+        $str .= '<li>';
+        $str .= HtmlInput::button_close($dialog_box);
+        $str .= '</li>';
+        
+        $s2 = $xml->createElement("ctl_row", "error_0");
+        $s4 = $xml->createElement("ctl", "error_0");
+        $s3 = $xml->createElement("html");
+        $s5 = $xml->createElement("ctl_pk_id", "0");
+        $t1 = $xml->createTextNode($str);
+        $s3->appendChild($t1);
+
+        $root = $xml->createElement("data");
+        $root->appendChild($s1);
+        $root->appendChild($s2);
+        $root->appendChild($s3);
+        $root->appendChild($s4);
+        $root->appendChild($s5);
+         $xml->appendChild($root);
+        return $xml;
+    }
 }