From a33553ed3ac0690558a780cefd79d0d1bf3ceb79 Mon Sep 17 00:00:00 2001 From: Benjamin DALSASS Date: Thu, 16 Jul 2026 14:41:59 +0200 Subject: [PATCH] =?UTF-8?q?N=C2=B09723=20-=20IsActionAllowed=20should=20wo?= =?UTF-8?q?rk=20with=20non=20instantiated=20users=20objects?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- addons/userrights/userrightsprofile.class.inc.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/addons/userrights/userrightsprofile.class.inc.php b/addons/userrights/userrightsprofile.class.inc.php index 1fc947be49..daeefcc9f5 100644 --- a/addons/userrights/userrightsprofile.class.inc.php +++ b/addons/userrights/userrightsprofile.class.inc.php @@ -582,7 +582,9 @@ class UserRightsProfile extends UserRightsAddOnAPI */ public function ListProfiles($oUser) { - if (count($oUser->ListChanges()) === 0) { // backward compatibility + if (!array_key_exists('profile_list', $oUser->ListChanges())) { + // Profiles list is not modified on the $oUser object, we can use DBObjectSearch with `all data` capabilities + // Note: This is the default behavior $aRet = []; $oSearch = new DBObjectSearch('URP_UserProfile'); $oSearch->AllowAllData(); @@ -595,6 +597,8 @@ class UserRightsProfile extends UserRightsAddOnAPI return $aRet; } else { + // Profiles list must be computed with memory changes. + // Note: this is a bit tricky because the user object may have been modified in memory (e.g. a profile added or removed) and we need to take that into account $aRet = []; $oProfilesSet = $oUser->Get('profile_list'); foreach ($oProfilesSet as $oUserProfile) {