blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-20 08:22:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

PermissionLib->isEntitled is NOT checking anymore if the HTTP method to access to the

Browse Source 
controller method is POST or GET to define what permission type (RW/SUID) is needed
This commit is contained in:
Paolo
2018-06-28 16:34:26 +02:00
parent 8f566e0499
commit 99292f93a7
1 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/libraries/PermissionLib.php
+5 -7
View File
@@ -155,21 +155,19 @@ class PermissionLib
// Retrives permission and required access type from the $requiredPermissions array
list($permission, $requiredAccessType) = explode(PermissionLib::PERMISSION_SEPARATOR, $permissions[$pCounter]);
$accessType = null;
$accessType = '';
// Checks if the required access type is compliant with the HTTP method (GET => r, POST => w)
if ($requestMethod == self::READ_HTTP_METHOD
&& strpos($requiredAccessType, PermissionLib::READ_RIGHT) !== false)
if (strpos($requiredAccessType, PermissionLib::READ_RIGHT) !== false)
{
$accessType = PermissionLib::SELECT_RIGHT; // S
}
elseif ($requestMethod == self::WRITE_HTTP_METHOD
&& strpos($requiredAccessType, PermissionLib::WRITE_RIGHT) !== false)
if (strpos($requiredAccessType, PermissionLib::WRITE_RIGHT) !== false)
{
$accessType = PermissionLib::REPLACE_RIGHT.PermissionLib::DELETE_RIGHT; // UID
$accessType .= PermissionLib::REPLACE_RIGHT.PermissionLib::DELETE_RIGHT; // UID
}
if ($accessType != null) // if compliant
if (!isEmptyString($accessType)) // if compliant
{
// Checks if the user has the same required permissiond with the same required access type
$checkPermissions = $this->isBerechtigt($permission, $accessType);