composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-02-13 07:24:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

Security hardening

Browse Source
This commit is contained in:
jf-cbd
2024-12-13 15:05:52 +01:00
parent aa4376ca04
commit cb16e397a4
1 changed files with 0 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
datamodels/2.x/itop-portal-base/portal/src/Controller/ObjectController.php
View File

@@ -1228,8 +1228,6 @@ class ObjectController extends BrickController
$oRequestManipulator = $this->get('request_manipulator');
/** @var \Combodo\iTop\Portal\Helper\ScopeValidatorHelper $oScopeValidator */
$oScopeValidator = $this->get('scope_validator');
/** @var \Combodo\iTop\Portal\Helper\SecurityHelper $oSecurityHelper */
$oSecurityHelper = $this->get('security_helper');
$aData = array();
@@ -1266,12 +1264,6 @@ class ObjectController extends BrickController
// Retrieving objects
while ($oObject = $oSet->Fetch())
{
$sObjectId = $oObject->Get('id');
if (!$oSecurityHelper->IsActionAllowed(UR_ACTION_READ, $sObjectClass, $sObjectId))
{
IssueLog::Warning(__METHOD__.' at line '.__LINE__.' : User #'.UserRights::GetUserId().' not allowed to read '.$sObjectClass.'::'.$sObjectId.' object.');
throw new HttpException(Response::HTTP_NOT_FOUND, Dict::S('UI:ObjectDoesNotExist'));
}
$aData['items'][] = $this->PrepareObjectInformation($oObject, $aObjectAttCodes);
}