Fix Dolibarr#39063 enforce user write right on other users notes

The note editor set $permissionnote from user->self->write only, so a user
holding user->user->read plus user->self->write (but not user->user->write)
could edit the public/private notes of any user, admins included: the
setnote actions are not in restrictedArea's write-check list, so
$permissionnote was the only remaining guard. It now requires user->user->write
to edit another user's notes, matching caneditfield in user/card.php.

Reported by Abderrahmane Aksoum.

Signed-off-by: Dolicraft <contact@dolicraft.com>

Author: Dolicraft

htdocs/user/note.php

@@ -50,7 +50,9 @@
 }
 
 // Permissions
-$permissionnote = $user->hasRight("user", "self", "write"); // Used by the include of actions_setnotes.inc.php
+// Writing notes on own record needs the "self" write right, writing on another user's record needs the "user" write right.
+// Without this distinction a user holding only "self" write could edit the notes of any user, including admins.
+$permissionnote = ((($object->id == $user->id) && $user->hasRight("user", "self", "write")) || (($object->id != $user->id) && $user->hasRight("user", "user", "write"))); // Used by the include of actions_setnotes.inc.php
 
 // Security check
 $socid = 0;