From 6e6deaa462910a6fd32cbfc16d9fb695b44fe89d Mon Sep 17 00:00:00 2001
From: zhouxin <zhouxin@easycorp.ltd>
Date: Wed, 13 Apr 2022 07:59:57 +0000
Subject: [PATCH] * Fix bug #21374.

---
 module/common/model.php             | 2 ++
 module/product/view/browse.html.php | 6 ++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/module/common/model.php b/module/common/model.php
index 3ceaffc0e6..d5d43c2583 100644
--- a/module/common/model.php
+++ b/module/common/model.php
@@ -2738,6 +2738,8 @@ EOD;
     {
         global $config;
 
+        if(empty($object)) return true;
+
         if($type == 'product'   and empty($config->CRProduct)   and $object->status == 'closed') return false;
         if($type == 'execution' and empty($config->CRExecution) and $object->status == 'closed') return false;
 
diff --git a/module/product/view/browse.html.php b/module/product/view/browse.html.php
index 26c870a36a..a7e804d853 100644
--- a/module/product/view/browse.html.php
+++ b/module/product/view/browse.html.php
@@ -63,9 +63,9 @@ $projectIDParam = $isProjectStory ? "projectID=$projectID&" : '';
       <ul class='dropdown-menu' style='max-height:240px; max-width: 300px; overflow-y:auto'>
         <?php
         echo "<li>" . html::a($this->createLink('projectstory', 'story', "projectID=$projectID"), $lang->product->all)  . "</li>";
-        foreach($projectProducts as $product)
+        foreach($projectProducts as $projectProduct)
         {
-            echo "<li>" . html::a($this->createLink('projectstory', 'story', "projectID=$projectID&productID=$product->id&branch=all"), $product->name, '', "title='{$product->name}' class='text-ellipsis'") . "</li>";
+            echo "<li>" . html::a($this->createLink('projectstory', 'story', "projectID=$projectID&productID=$projectProduct->id&branch=all"), $projectProduct->name, '', "title='{$projectProduct->name}' class='text-ellipsis'") . "</li>";
         }
         ?>
       </ul>
@@ -143,6 +143,7 @@ $projectIDParam = $isProjectStory ? "projectID=$projectID&" : '';
         ?>
       </ul>
     </div>
+    <?php if(common::canModify('product', $product)):?>
     <div class='btn-group dropdown'>
       <?php
       $createStoryLink = $this->createLink('story', 'create', "product=$productID&branch=$branch&moduleID=$moduleID&storyID=0&projectID=$projectID&bugID=0&planID=0&todoID=0&extra=&type=$storyType");
@@ -227,6 +228,7 @@ $projectIDParam = $isProjectStory ? "projectID=$projectID&" : '';
     }
     ?>
     </div>
+    <?php endif;?>
   </div>
   <?php endif;?>
 </div>