|
@@ -65,9 +65,14 @@ if (!empty($user->socid)) {
|
|
|
$socid = $user->socid;
|
|
|
}
|
|
|
|
|
|
-/*if (empty($conf->global->MAIN_DIRECT_STATUS_UPDATE)) {
|
|
|
- accessforbidden('Calling this file is allowed only when MAIN_DIRECT_STATUS_UPDATE is set');
|
|
|
-}*/
|
|
|
+if (in_array($field, array('status'))) {
|
|
|
+ restrictedArea($user, $element, $id);
|
|
|
+} elseif ($element == 'product' && in_array($field, array('tosell', 'tobuy', 'tobatch'))) { // Special case for products
|
|
|
+ restrictedArea($user, 'produit|service', $id, 'product&product', '', '', 'rowid');
|
|
|
+} else {
|
|
|
+ accessforbidden("Bad value for combination of parameters element/field.", 0, 0, 1);
|
|
|
+ exit;
|
|
|
+}
|
|
|
|
|
|
|
|
|
/*
|
|
@@ -78,15 +83,6 @@ top_httphead();
|
|
|
|
|
|
print '<!-- Ajax page called with url '.dol_escape_htmltag($_SERVER["PHP_SELF"]).'?'.dol_escape_htmltag($_SERVER["QUERY_STRING"]).' -->'."\n";
|
|
|
|
|
|
-if (in_array($field, array('status'))) {
|
|
|
- restrictedArea($user, $element, $id);
|
|
|
-} elseif ($element == 'product' && in_array($field, array('tosell', 'tobuy', 'tobatch'))) { // Special case for products
|
|
|
- restrictedArea($user, 'produit|service', $id, 'product&product', '', '', 'rowid');
|
|
|
-} else {
|
|
|
- accessforbidden("Bad value for combination of parameters element/field.", 0, 0, 1);
|
|
|
- exit;
|
|
|
-}
|
|
|
-
|
|
|
// Registering new values
|
|
|
if (($action == 'set') && !empty($id)) {
|
|
|
$triggerkey = strtoupper($element).'_UPDATE';
|