composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-04-21 09:38:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°9231 - Make OrmDocument apply same safety to attachments and regular documents (#860)

Browse Source
This commit is contained in:
Stephen Abello
2026-03-30 15:25:52 +02:00
committed by GitHub
parent 3406ca79de
commit 7791585387
2 changed files with 131 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
core/ormdocument.class.inc.php
View File

@@ -350,15 +350,18 @@ class ormDocument
if (!is_object($oObj)) {
// If access to the document is not granted, check if the access to the host object is allowed
$oObj = MetaModel::GetObject($sClass, $id, false, true);
$bHasHostRights = false;
if ($oObj instanceof Attachment) {
$sItemClass = $oObj->Get('item_class');
$sItemId = $oObj->Get('item_id');
$oHost = MetaModel::GetObject($sItemClass, $sItemId, false, false);
if (!is_object($oHost)) {
$oObj = null;
if (is_object($oHost)) {
$bHasHostRights = true;
}
}
if (!is_object($oObj)) {
// We could neither read the object nor get a host object matching our rights
if ($bHasHostRights !== true) {
throw new Exception("Invalid id ($id) for class '$sClass' - the object does not exist or you are not allowed to view it");
}
}