From 99292f93a7568e8822fe43ac34a965f626cfb93e Mon Sep 17 00:00:00 2001 From: Paolo Date: Thu, 28 Jun 2018 16:34:26 +0200 Subject: [PATCH] PermissionLib->isEntitled is NOT checking anymore if the HTTP method to access to the controller method is POST or GET to define what permission type (RW/SUID) is needed --- application/libraries/PermissionLib.php | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/application/libraries/PermissionLib.php b/application/libraries/PermissionLib.php index dbfd2a018..8b10678da 100644 --- a/application/libraries/PermissionLib.php +++ b/application/libraries/PermissionLib.php @@ -155,21 +155,19 @@ class PermissionLib // Retrives permission and required access type from the $requiredPermissions array list($permission, $requiredAccessType) = explode(PermissionLib::PERMISSION_SEPARATOR, $permissions[$pCounter]); - $accessType = null; + $accessType = ''; // Checks if the required access type is compliant with the HTTP method (GET => r, POST => w) - if ($requestMethod == self::READ_HTTP_METHOD - && strpos($requiredAccessType, PermissionLib::READ_RIGHT) !== false) + if (strpos($requiredAccessType, PermissionLib::READ_RIGHT) !== false) { $accessType = PermissionLib::SELECT_RIGHT; // S } - elseif ($requestMethod == self::WRITE_HTTP_METHOD - && strpos($requiredAccessType, PermissionLib::WRITE_RIGHT) !== false) + if (strpos($requiredAccessType, PermissionLib::WRITE_RIGHT) !== false) { - $accessType = PermissionLib::REPLACE_RIGHT.PermissionLib::DELETE_RIGHT; // UID + $accessType .= PermissionLib::REPLACE_RIGHT.PermissionLib::DELETE_RIGHT; // UID } - if ($accessType != null) // if compliant + if (!isEmptyString($accessType)) // if compliant { // Checks if the user has the same required permissiond with the same required access type $checkPermissions = $this->isBerechtigt($permission, $accessType);