diff --git a/includes/runtime/Controller.php b/includes/runtime/Controller.php index dee9aa491115a833b9a97920753e170bd26f84f3..4d55354afd24b28b9230e1617a0db0aa9e6d9b8c 100644 --- a/includes/runtime/Controller.php +++ b/includes/runtime/Controller.php @@ -111,27 +111,38 @@ abstract class Vtiger_Action_Controller extends Vtiger_Controller { function requiresPermission(Vtiger_Request $request) { return array(); } - - function checkPermission(Vtiger_Request $request) { - $permissions = $this->requiresPermission($request); - foreach($permissions as $permission) { - if(array_key_exists('module_parameter', $permission)){ - $moduleParameter = $request->get($permission['module_parameter']); - }else{ - $moduleParameter = 'module'; - } - if(array_key_exists('record_parameter', $permission)){ - $recordParameter = $request->get($permission['record_parameter']); - }else{ - $recordParameter = ''; - } - if(!Users_Privileges_Model::isPermitted($moduleParameter, $permission['action'], $recordParameter)) { - throw new AppException(vtranslate('LBL_PERMISSION_DENIED')); - } - if(Vtiger_Runtime::isRestricted('modules',$moduleParameter)){} - } - return true; - } + + /** + * @param Vtiger_Request $request + * + * @return bool + * @throws AppException + */ + function checkPermission(Vtiger_Request $request) + { + $permissions = $this->requiresPermission($request); + foreach ($permissions as $permission) { + if (array_key_exists('module_parameter', $permission)) { + if ($request->has($permission['module_parameter']) && !empty($request->get($permission['module_parameter']))) { + $moduleParameter = $request->get($permission['module_parameter']); + } elseif ($request->has('record') && !empty($request->get('record'))) { + $moduleParameter = getSalesEntityType($request->get('record')); + } + } else { + $moduleParameter = 'module'; + } + if (array_key_exists('record_parameter', $permission)) { + $recordParameter = $request->get($permission['record_parameter']); + } else { + $recordParameter = ''; + } + if (!Users_Privileges_Model::isPermitted($moduleParameter, $permission['action'], $recordParameter)) { + throw new AppException(vtranslate('LBL_PERMISSION_DENIED')); + } + } + + return true; + } } /**