Impossible to reset user password with multicompany no transverse mode and hidden entity selector
Bug
If we have the multicompany plugin, in normal mode no MULTICOMPANY_TRANSVERSE_MODE and we hide the entity selector in the login page. Then in the reset password page we can only request password reset for the entity 1.
Dolibarr Version
23.x
Environment PHP
No response
Environment Database
No response
Steps to reproduce the behavior and expected behavior
When a user requests a password reset, Dolibarr tries to fetch the user from the current entity, 1 in this case as the selector is not visible. This part can be easily fixed by setting entity to -1 in the two call to User::fetch.
Still there is a second issue, once the user is fetch, Dolibarrs loads the user rights $editeduser->loadRights(), this methods uses $conf->entity which once again was not set as the selector was not present, therefore Dolibarr concludes that the user cannot change their password as the rights are loaded from entity 1.
The following patch fixes the issue for me, but I think that it put some code from multicompany at the wrong place, so I think it can be improved
diff --git a/htdocs/user/passwordforgotten.php b/htdocs/user/passwordforgotten.php
index 7543606709e..eae5404887f 100644
--- a/htdocs/user/passwordforgotten.php
+++ b/htdocs/user/passwordforgotten.php
@@ -140,13 +140,17 @@ if (empty($reshook)) {
$isanemail = preg_match('/@/', $username);
$edituser = new User($db);
- $result = $edituser->fetch(0, $username, '', 1, $conf->entity);
+ $result = $edituser->fetch(0, $username, '', 1, -1);
if ($result == 0 && $isanemail) {
- $result = $edituser->fetch(0, '', '', 1, $conf->entity, $username);
+ $result = $edituser->fetch(0, '', '', 1, -1, $username);
}
// If the user does not have the right to change his own password
if ($result > 0) {
+ if (isModEnabled('multicompany') && !getDolGlobalString('MULTICOMPANY_TRANSVERSE_MODE') && $conf->entity != $edituser->entity) {
+ $object = new ActionsMulticompany($db);
+ $object->switchEntity($edituser->entity);
+ }
$edituser->loadRights('user');
if (!$edituser->hasRight('user', 'self', 'password')) {
$result = 0;Attached files
No response
Source: Dolibarr/dolibarr