Skip to content
Snippets Groups Projects
Commit 1e64f796 authored by Prasad's avatar Prasad
Browse files

Pushing security fixes for 7.1.0

parent 30829c48
No related branches found
No related tags found
No related merge requests found
......@@ -19,6 +19,7 @@ class Vtiger_Request {
* Default constructor
*/
function __construct($values, $rawvalues = array(), $stripifgpc=true) {
Vtiger_Functions::validateRequestParameters($values);
$this->valuemap = $values;
$this->rawvaluemap = $rawvalues;
if ($stripifgpc && !empty($this->valuemap) && get_magic_quotes_gpc()) {
......
......@@ -15,9 +15,20 @@ class Users_Save_Action extends Vtiger_Save_Action {
$record = $request->get('record');
$recordModel = Vtiger_Record_Model::getInstanceById($record, $moduleName);
$currentUserModel = Users_Record_Model::getCurrentUserModel();
if(!Users_Privileges_Model::isPermitted($moduleName, 'Save', $record) || ($recordModel->isAccountOwner() &&
$currentUserModel->get('id') != $recordModel->getId() && !$currentUserModel->isAdminUser())) {
throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
// Check for operation access.
$allowed = Users_Privileges_Model::isPermitted($moduleName, 'Save', $record);
if ($allowed) {
// Deny access if not administrator or account-owner or self
if(!$currentUserModel->isAdminUser()) {
if (empty($record)) {
$allowed = false;
} else if (($currentUserModel->get('id') != $recordModel->getId())) {
$allowed = false;
}
}
}
if(!$allowed) {
throw new AppException('LBL_PERMISSION_DENIED');
}
}
......@@ -58,6 +69,10 @@ class Users_Save_Action extends Vtiger_Save_Action {
if ($fieldName == 'is_owner') {
$fieldValue = null;
}
if ($fieldName == 'roleid' && !($currentUserModel->isAdminUser())) {
$fieldValue = null;
}
if($fieldValue !== null) {
if(!is_array($fieldValue)) {
$fieldValue = trim($fieldValue);
......
......@@ -86,7 +86,7 @@ class Users_SaveAjax_Action extends Vtiger_SaveAjax_Action {
$recordModel->set($fieldName, 'off');
}
if($fieldName == "is_owner") {
if($fieldName == "is_owner" || $fieldName == "roleid") {
$recordId = $request->get('record');
$moduleName = $request->getModule();
if(!empty($recordId)) {
......@@ -137,7 +137,6 @@ class Users_SaveAjax_Action extends Vtiger_SaveAjax_Action {
$recordModel->set('status', 'Active');
$recordModel->set('id', $record);
$recordModel->set('mode', 'edit');
$recordModel->set('user_hash', $recordModel->getUserHash());
$recordModel->save();
$db = PearDatabase::getInstance();
......@@ -213,4 +212,4 @@ class Users_SaveAjax_Action extends Vtiger_SaveAjax_Action {
}
$response->emit();
}
}
\ No newline at end of file
}
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment