From 1d867778dd9b829f44657d9112d237a873b78971 Mon Sep 17 00:00:00 2001
From: Dany De Bontridder <dany@alchimerys.be>
Date: Sat, 24 Oct 2015 14:32:03 +0200
Subject: [PATCH] security

---
 html/ajax_misc.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/html/ajax_misc.php b/html/ajax_misc.php
index d74da57ce..f5b2777bd 100644
--- a/html/ajax_misc.php
+++ b/html/ajax_misc.php
@@ -71,7 +71,9 @@ if ($gDossier<>0) {
     $g_parameter=new Own($cn);
     $g_user = new User($cn);
     $g_user->check(true);
-    $g_user->check_dossier($gDossier, true);
+    if ( $g_user->check_dossier($gDossier, true) == 'X' ) {
+        die(_('Non autorisé'))
+    }
 }
 else
 {