diff --git a/html/access.php b/html/access.php
index 3dde43316..21398123a 100644
--- a/html/access.php
+++ b/html/access.php
@@ -33,12 +33,10 @@ require_once ('class_dossier.php');
require_once('class_todo_list.php');
-$user=new User(DbConnect());
-$user->check_dossier(dossier::id());
-
$cn=DbConnect(dossier::id());
-$user->db=$cn;
+$user=new User($cn);
$user->Check();
+$user->check_dossier(dossier::id());
if ( DBVERSION!=dossier::get_version($cn)) {
echo '
Votre base de données n\'est pas à jour, ';
diff --git a/include/class_user.php b/include/class_user.php
index 7ce2d0511..e474e653b 100644
--- a/include/class_user.php
+++ b/include/class_user.php
@@ -255,6 +255,7 @@ jrn_def_name,jrn_def_class_deb,jrn_def_class_cred,jrn_type_id,jrn_desc,uj_priv,
/* for admin or local admin there is no restriction on the ledger */
if ($this->admin == 1 || $this->is_local_admin(dossier::id()) == 1) return ' jrn_def_id > 0 ';
$aLedger=$this->get_ledger($p_type,$p_access);
+ if ( empty ($aLedger)) return ' jrn_def_id < 0 ';
$sql=" jrn_def_id in (";
foreach ($aLedger as $row) {
$sql.=$row['jrn_def_id'].',';
@@ -613,10 +614,12 @@ jrn_def_name,jrn_def_class_deb,jrn_def_class_cred,jrn_type_id,jrn_desc,uj_priv,
}
function check_dossier($p_dossier_id)
{
+ $this->Admin();
+ if ( $this->admin==1) return 'L';
$cn=DbConnect();
- $dossier=getDbValue($cn,"select priv_priv from jnt_use_dos join priv_user on (priv_jnt=jnt_id) where dos_id=$1",
- array($p_dossier_id));
+ $dossier=getDbValue($cn,"select priv_priv from jnt_use_dos join priv_user on (priv_jnt=jnt_id) where dos_id=$1 and use_id=$2",
+ array($p_dossier_id,$this->id));
if ( $dossier=='X' || $dossier=='') {
alert('Dossier non accessible');
exit();
diff --git a/include/constant.php b/include/constant.php
index 725c4d89c..db40861cc 100644
--- a/include/constant.php
+++ b/include/constant.php
@@ -31,7 +31,7 @@ define ("DBVERSION",57);
define ("MAX_COMPTE",4);
define ('MAX_BUD_DETAIL',20);
define ('MAX_ARTICLE',8);
-define ("DEBUG","true");
+define ("DEBUG","false");
// Erreur
define ("NOERROR",0);