From 1f1f69261a4694ada0900e8bf2d6bdedd5d4d2c6 Mon Sep 17 00:00:00 2001 From: Dany De Bontridder Date: Thu, 24 Nov 2011 14:45:36 +0000 Subject: [PATCH] #472 protect ajax for stock and ANCODS --- html/ajax_misc.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/html/ajax_misc.php b/html/ajax_misc.php index 3420617d1..efee8c4f3 100644 --- a/html/ajax_misc.php +++ b/html/ajax_misc.php @@ -66,9 +66,11 @@ $html = var_export($_REQUEST, true); switch ($op) { case "remove_anc": + if ($user->check_module('ANCODS') == 0) exit(); $cn->exec_sql("delete from operation_analytique where oa_group=$1", array($_GET['oa'])); break; case "rm_stock": + if ($user->check_module('STOCK') == 0) exit(); require_once('constant.security.php'); $cn->exec_sql('delete from stock_goods where sg_id=$1', array($s_id)); $html = escape_xml($s_id);