@@ -84,7 +84,7 @@ public function get($id, $properties = '', $withLines = true)
8484 }
8585
8686 if (!DolibarrApi::_checkAccessToResource ('contrat ' , $ this ->contract ->id )) {
87- throw new RestException (403 , 'Access not allowed for login ' .DolibarrApiAccess::$ user ->login );
87+ throw new RestException (403 , 'Access to this contract is not allowed for login ' .DolibarrApiAccess::$ user ->login );
8888 }
8989
9090 $ this ->contract ->fetchObjectLinked ();
@@ -175,7 +175,6 @@ public function index($sortfield = "t.rowid", $sortorder = 'ASC', $limit = 100,
175175 $ sql .= $ this ->db ->plimit ($ limit + 1 , $ offset );
176176 }
177177
178- dol_syslog ("API Rest request " );
179178 $ result = $ this ->db ->query ($ sql );
180179
181180 if ($ result ) {
@@ -234,8 +233,19 @@ public function post($request_data = null)
234233 {
235234 global $ conf ;
236235 if (!DolibarrApiAccess::$ user ->hasRight ('contrat ' , 'creer ' )) {
237- throw new RestException (403 , "Insufficient rights " );
236+ throw new RestException (403 , "Missing permission: Create/modify contracts/subscriptions " );
238237 }
238+
239+ $ socid = (int ) $ request_data ['socid ' ];
240+ $ thirdpartytmp = new Societe ($ this ->db );
241+ $ thirdparty_result = $ thirdpartytmp ->fetch ($ socid );
242+ if ($ thirdparty_result < 1 ) {
243+ throw new RestException (404 , 'Thirdparty with id= ' .$ socid .' not found or not allowed ' );
244+ }
245+ if (!DolibarrApi::_checkAccessToResource ('societe ' , $ thirdpartytmp ->id )) {
246+ throw new RestException (404 , 'Thirdparty with id= ' .$ thirdpartytmp ->id .' not found or not allowed ' );
247+ }
248+
239249 // Check mandatory fields
240250 $ result = $ this ->_validate ($ request_data );
241251
@@ -308,7 +318,7 @@ public function getLines($id, $sortfield = "d.rowid", $sortorder = 'ASC', $limit
308318 }
309319
310320 if (!DolibarrApi::_checkAccessToResource ('contrat ' , $ this ->contract ->id )) {
311- throw new RestException (403 , 'Access not allowed for login ' .DolibarrApiAccess::$ user ->login );
321+ throw new RestException (403 , 'Access to this contract is not allowed for login ' .DolibarrApiAccess::$ user ->login );
312322 }
313323
314324 $ obj_ret = [];
@@ -340,7 +350,6 @@ public function getLines($id, $sortfield = "d.rowid", $sortorder = 'ASC', $limit
340350 $ sql .= $ this ->db ->plimit ($ limit + 1 , $ offset );
341351 }
342352
343- dol_syslog ("API Rest request " );
344353 $ result = $ this ->db ->query ($ sql );
345354 if ($ result ) {
346355 $ num = $ this ->db ->num_rows ($ result );
@@ -400,7 +409,7 @@ public function postLine($id, $request_data = null)
400409 }
401410
402411 if (!DolibarrApi::_checkAccessToResource ('contrat ' , $ this ->contract ->id )) {
403- throw new RestException (403 , 'Access not allowed for login ' .DolibarrApiAccess::$ user ->login );
412+ throw new RestException (403 , 'Access to this contract is not allowed for login ' .DolibarrApiAccess::$ user ->login );
404413 }
405414
406415 $ request_data = (object ) $ request_data ;
@@ -460,7 +469,7 @@ public function putLine($id, $lineid, $request_data = null)
460469 }
461470
462471 if (!DolibarrApi::_checkAccessToResource ('contrat ' , $ this ->contract ->id )) {
463- throw new RestException (403 , 'Access not allowed for login ' .DolibarrApiAccess::$ user ->login );
472+ throw new RestException (403 , 'Access to this contract is not allowed for login ' .DolibarrApiAccess::$ user ->login );
464473 }
465474
466475 $ request_data = (object ) $ request_data ;
@@ -611,7 +620,7 @@ public function activateLine($id, $lineid, $datestart, $dateend = null, $comment
611620 }
612621
613622 if (!DolibarrApi::_checkAccessToResource ('contrat ' , $ this ->contract ->id )) {
614- throw new RestException (403 , 'Access not allowed for login ' .DolibarrApiAccess::$ user ->login );
623+ throw new RestException (403 , 'Access to this contract is not allowed for login ' .DolibarrApiAccess::$ user ->login );
615624 }
616625
617626 $ updateRes = $ this ->contract ->active_line (DolibarrApiAccess::$ user , $ lineid , (int ) $ datestart , $ dateend , $ comment );
@@ -652,7 +661,7 @@ public function unactivateLine($id, $lineid, $datestart, $comment = null)
652661 }
653662
654663 if (!DolibarrApi::_checkAccessToResource ('contrat ' , $ this ->contract ->id )) {
655- throw new RestException (403 , 'Access not allowed for login ' .DolibarrApiAccess::$ user ->login );
664+ throw new RestException (403 , 'Access to this contract is not allowed for login ' .DolibarrApiAccess::$ user ->login );
656665 }
657666
658667 $ updateRes = $ this ->contract ->close_line (DolibarrApiAccess::$ user , $ lineid , (int ) $ datestart , $ comment );
@@ -692,7 +701,7 @@ public function deleteLine($id, $lineid)
692701 }
693702
694703 if (!DolibarrApi::_checkAccessToResource ('contrat ' , $ this ->contract ->id )) {
695- throw new RestException (403 , 'Access not allowed for login ' .DolibarrApiAccess::$ user ->login );
704+ throw new RestException (403 , 'Access to this contract is not allowed for login ' .DolibarrApiAccess::$ user ->login );
696705 }
697706
698707 // TODO Check the lineid $lineid is a line of object
@@ -727,13 +736,24 @@ public function put($id, $request_data = null)
727736 if ($ id == 0 ) {
728737 throw new RestException (400 , 'No contract with id=0 can exist ' );
729738 }
739+
730740 $ result = $ this ->contract ->fetch ($ id );
731741 if (!$ result ) {
732742 throw new RestException (404 , 'Contrat not found ' );
733743 }
734744
745+ $ old_socid = $ this ->contract ->socid ;
746+ $ oldthirdpartytmp = new Societe ($ this ->db );
747+ $ old_thirdparty_result = $ oldthirdpartytmp ->fetch ($ old_socid );
748+ if ($ old_thirdparty_result < 1 ) {
749+ throw new RestException (404 , 'Thirdparty with id= ' .$ old_socid .' not found or not allowed ' );
750+ }
751+ if (!DolibarrApi::_checkAccessToResource ('societe ' , $ old_socid )) {
752+ throw new RestException (403 , 'Access to old thirdparty= ' .$ old_socid .' is not allowed for login ' .DolibarrApiAccess::$ user ->login );
753+ }
754+
735755 if (!DolibarrApi::_checkAccessToResource ('contrat ' , $ this ->contract ->id )) {
736- throw new RestException (403 , 'Access not allowed for login ' .DolibarrApiAccess::$ user ->login );
756+ throw new RestException (403 , 'Access to this contract is not allowed for login ' .DolibarrApiAccess::$ user ->login );
737757 }
738758 foreach ($ request_data as $ field => $ value ) {
739759 if ($ field == 'id ' ) {
@@ -763,6 +783,18 @@ public function put($id, $request_data = null)
763783 continue ;
764784 }
765785
786+ if ($ field == 'socid ' ) {
787+ $ new_socid = (int ) $ value ;
788+ $ loopthirdpartytmp = new Societe ($ this ->db );
789+ $ new_thirdparty_result = $ loopthirdpartytmp ->fetch ($ new_socid );
790+ if ($ new_thirdparty_result < 1 ) {
791+ throw new RestException (404 , 'Thirdparty with id= ' .$ new_socid .' not found or not allowed ' );
792+ }
793+ if (!DolibarrApi::_checkAccessToResource ('societe ' , $ new_socid )) {
794+ throw new RestException (403 , 'Access to new thirdparty= ' .$ new_socid .' is not allowed for login ' .DolibarrApiAccess::$ user ->login );
795+ }
796+ }
797+
766798 $ this ->contract ->$ field = $ this ->_checkValForAPI ($ field , $ value , $ this ->contract );
767799 }
768800
@@ -790,7 +822,7 @@ public function put($id, $request_data = null)
790822 public function delete ($ id )
791823 {
792824 if (!DolibarrApiAccess::$ user ->hasRight ('contrat ' , 'supprimer ' )) {
793- throw new RestException (403 );
825+ throw new RestException (403 , ' Missing permission: Delete contracts/subscriptions ' );
794826 }
795827 if ($ id == 0 ) {
796828 throw new RestException (400 , 'No contract with id=0 can exist ' );
@@ -801,7 +833,7 @@ public function delete($id)
801833 }
802834
803835 if (!DolibarrApi::_checkAccessToResource ('contrat ' , $ this ->contract ->id )) {
804- throw new RestException (403 , 'Access not allowed for login ' .DolibarrApiAccess::$ user ->login );
836+ throw new RestException (403 , 'Access to this contract is not allowed for login ' .DolibarrApiAccess::$ user ->login );
805837 }
806838
807839 if (!$ this ->contract ->delete (DolibarrApiAccess::$ user )) {
@@ -854,7 +886,7 @@ public function validate($id, $notrigger = 0)
854886 }
855887
856888 if (!DolibarrApi::_checkAccessToResource ('contrat ' , $ this ->contract ->id )) {
857- throw new RestException (403 , 'Access not allowed for login ' .DolibarrApiAccess::$ user ->login );
889+ throw new RestException (403 , 'Access to this contract is not allowed for login ' .DolibarrApiAccess::$ user ->login );
858890 }
859891
860892 $ result = $ this ->contract ->validate (DolibarrApiAccess::$ user , '' , $ notrigger );
@@ -911,7 +943,7 @@ public function close($id, $notrigger = 0)
911943 }
912944
913945 if (!DolibarrApi::_checkAccessToResource ('contrat ' , $ this ->contract ->id )) {
914- throw new RestException (403 , 'Access not allowed for login ' .DolibarrApiAccess::$ user ->login );
946+ throw new RestException (403 , 'Access to this contract is not allowed for login ' .DolibarrApiAccess::$ user ->login );
915947 }
916948
917949 $ result = $ this ->contract ->closeAll (DolibarrApiAccess::$ user , $ notrigger );
0 commit comments