composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-04-25 19:48:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

(Retrofit from deveop ab1715ed) N°1576 Portal: Security hardening.

Browse Source
This commit is contained in:
Guillaume Lajarige
2018-07-25 16:48:11 +02:00
committed by Molkobain
parent fcb6a4069a
commit e3e416b467
4 changed files with 28 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
datamodels/2.x/itop-portal-base/portal/src/controllers/objectcontroller.class.inc.php
View File

@@ -40,6 +40,7 @@ use ListExpression;
use ScalarExpression;
use DBObjectSet;
use AttributeEnum;
use AttributeImage;
use AttributeFinalClass;
use AttributeFriendlyName;
use UserRights;
@@ -1597,7 +1598,7 @@ class ObjectController extends AbstractController
if ($oAttDef->IsExternalKey())
{
$aAttData['value'] = $oObject->Get($oAttDef->GetCode() . '_friendlyname');
$aAttData['value'] = $oObject->GetAsHTML($oAttDef->GetCode() . '_friendlyname');
// Checking if user can access object's external key
if (SecurityHelper::IsActionAllowed($oApp, UR_ACTION_READ, $oAttDef->GetTargetClass()))
@@ -1610,9 +1611,22 @@ class ObjectController extends AbstractController
// We skip it
continue;
}
elseif ($oAttDef instanceof AttributeImage)
{
$oOrmDoc = $oObject->Get($oAttDef->GetCode());
if (is_object($oOrmDoc) && !$oOrmDoc->IsEmpty())
{
$sUrl = $oApp['url_generator']->generate('p_object_document_display', array('sObjectClass' => get_class($oObject), 'sObjectId' => $oObject->GetKey(), 'sObjectField' => $oAttDef->GetCode(), 'cache' => 86400));
}
else
{
$sUrl = $oAttDef->Get('default_image');
}
$aAttData['value'] = '<img src="' . $sUrl . '" />';
}
else
{
$aAttData['value'] = $oAttDef->GetValueLabel($oObject->Get($oAttDef->GetCode()));
$aAttData['value'] = $oAttDef->GetAsHTML($oObject->Get($oAttDef->GetCode()));
if ($oAttDef instanceof AttributeFriendlyName)
{