composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-05-18 23:08:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°5168 - Security hardening

Browse Source
This commit is contained in:
Benjamin Dalsass
2022-05-31 16:28:02 +02:00
parent 95dafc87c0
commit 9fd10bd73e
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
datamodels/2.x/itop-portal-base/portal/src/Helper/ObjectFormHandlerHelper.php
View File

@@ -297,6 +297,7 @@ class ObjectFormHandlerHelper
throw new HttpException(Response::HTTP_INTERNAL_SERVER_ERROR, 'Parameters formmanager_class and formmanager_data must be defined.'); throw new HttpException(Response::HTTP_INTERNAL_SERVER_ERROR, 'Parameters formmanager_class and formmanager_data must be defined.');
} }
$this->CheckReadFormDataAllowed($sFormManagerData);
$oFormManager = $sFormManagerClass::FromJSON($sFormManagerData); $oFormManager = $sFormManagerClass::FromJSON($sFormManagerData);
$oFormManager->SetContainer($this->oContainer); $oFormManager->SetContainer($this->oContainer);
@@ -435,6 +436,29 @@ class ObjectFormHandlerHelper
return $oTwig->render($sId, $aData); return $oTwig->render($sId, $aData);
} }
/**
* Check if read object include in form data is allowed, throw an exception otherwise.
*
* @since 2.7.7
*
* @param $sFormManagerData form data to check
*
* @return void
* @throws \CoreException
* @throws \MissingQueryArgument
* @throws \MySQLException
* @throws \MySQLHasGoneAwayException
* @throws \OQLException
*/
public function CheckReadFormDataAllowed($sFormManagerData){
$aJsonFromData = json_decode($sFormManagerData, true);
if(isset($aJsonFromData['formobject_class'])
&& isset($aJsonFromData['formobject_id'])
&& !$this->oSecurityHelper->IsActionAllowed(UR_ACTION_READ, $aJsonFromData['formobject_class'], $aJsonFromData['formobject_id'])){
throw new HttpException(Response::HTTP_INTERNAL_SERVER_ERROR, 'Form data access denied.');
}
}
/** /**
* Return an array of the available modes for a form. * Return an array of the available modes for a form.
* *