composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-04-19 16:48:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

security hardening

Browse Source
This commit is contained in:
jf-cbd
2024-11-27 14:47:44 +01:00
parent e03033ce52
commit aa4376ca04
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
datamodels/2.x/itop-portal-base/portal/src/Controller/ObjectController.php
View File

@@ -1228,6 +1228,8 @@ class ObjectController extends BrickController
$oRequestManipulator = $this->get('request_manipulator');
/** @var \Combodo\iTop\Portal\Helper\ScopeValidatorHelper $oScopeValidator */
$oScopeValidator = $this->get('scope_validator');
/** @var \Combodo\iTop\Portal\Helper\SecurityHelper $oSecurityHelper */
$oSecurityHelper = $this->get('security_helper');
$aData = array();
@@ -1246,7 +1248,8 @@ class ObjectController extends BrickController
$bIgnoreSilos = $oScopeValidator->IsAllDataAllowedForScope(UserRights::ListProfiles(), $sObjectClass);
$aParams = array('objects_id' => $aObjectIds);
$oSearch = DBObjectSearch::FromOQL("SELECT $sObjectClass WHERE id IN (:objects_id)");
if ($bIgnoreSilos === true)
$oScopeValidator->AddScopeToQuery($oSearch, $sObjectClass);
if ($bIgnoreSilos === true)
{
$oSearch->AllowAllData();
}
@@ -1263,6 +1266,12 @@ class ObjectController extends BrickController
// Retrieving objects
while ($oObject = $oSet->Fetch())
{
$sObjectId = $oObject->Get('id');
if (!$oSecurityHelper->IsActionAllowed(UR_ACTION_READ, $sObjectClass, $sObjectId))
{
IssueLog::Warning(__METHOD__.' at line '.__LINE__.' : User #'.UserRights::GetUserId().' not allowed to read '.$sObjectClass.'::'.$sObjectId.' object.');
throw new HttpException(Response::HTTP_NOT_FOUND, Dict::S('UI:ObjectDoesNotExist'));
}
$aData['items'][] = $this->PrepareObjectInformation($oObject, $aObjectAttCodes);
}