composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-04-25 19:48:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°2836 - Portal: Introduce bubbles conversation as default caselog rendering

Browse Source
This commit is contained in:
Molkobain
2020-10-24 12:52:39 +02:00
parent 95a2ffa0f2
commit 27e1f3d64b
7 changed files with 1029 additions and 365 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
datamodels/2.x/itop-portal-base/portal/src/Controller/ObjectController.php
View File

@@ -1025,6 +1025,7 @@ class ObjectController extends BrickController
$sObjectClass = $oRequestManipulator->ReadParam('sObjectClass', '');
$sObjectId = $oRequestManipulator->ReadParam('sObjectId', '');
$sObjectField = $oRequestManipulator->ReadParam('sObjectField', '');
$bCheckSecurity = true;
// When reaching to an Attachment, we have to check security on its host object instead of the Attachment itself
if ($sObjectClass === 'Attachment')
@@ -1037,11 +1038,17 @@ class ObjectController extends BrickController
{
$sHostClass = $sObjectClass;
$sHostId = $sObjectId;
// Security bypass for the image attribute of a class
// Note: This will be changed with a proper DM check when corresponding bug is being worked on
if(is_a($sObjectClass, 'Contact', true) && ($sObjectField === 'picture')){
$bCheckSecurity = false;
}
}
// Checking security layers
// Note: Checking if host object already exists as we can try to download document from an object that is being created
if (($sHostId > 0) && !$oSecurityHelper->IsActionAllowed(UR_ACTION_READ, $sHostClass, $sHostId))
if (($bCheckSecurity === true) && ($sHostId > 0) && !$oSecurityHelper->IsActionAllowed(UR_ACTION_READ, $sHostClass, $sHostId))
{
IssueLog::Warning(__METHOD__.' at line '.__LINE__.' : User #'.UserRights::GetUserId().' not allowed to retrieve document from attribute '.$sObjectField.' as it not allowed to read '.$sHostClass.'::'.$sHostId.' object.');
throw new HttpException(Response::HTTP_NOT_FOUND, Dict::S('UI:ObjectDoesNotExist'));