TriggerCheckPermission from webui is been removed, to make sure all handlers... (41671c1c) · Commits · vtiger / vtigercrm

includes/main/WebUI.php

+8 −8

Original line number	Diff line number	Diff line
		@@ -194,16 +194,16 @@ class Vtiger_WebUI extends Vtiger_EntryPoint {
		}

		//TODO : Need to review the design as there can potential security threat
		$skipList = array('Users', 'Home', 'CustomView', 'Import', 'Export', 'Inventory', 'Vtiger', 'PriceBooks', 'Migration', 'Install');

		if(!in_array($module, $skipList) && stripos($qualifiedModuleName, 'Settings') === false) {
		$this->triggerCheckPermission($handler, $request);
		}
		// $skipList = array('Users', 'Home', 'CustomView', 'Import', 'Export', 'Inventory', 'Vtiger', 'PriceBooks', 'Migration', 'Install');
		//
		// if(!in_array($module, $skipList) && stripos($qualifiedModuleName, 'Settings') === false) {
		// $this->triggerCheckPermission($handler, $request);
		// }

		// Every settings page handler should implement this method
		if(stripos($qualifiedModuleName, 'Settings') === 0 \|\| ($module == 'Users')) {
		// if(stripos($qualifiedModuleName, 'Settings') === 0 \|\| ($module == 'Users')) {
		$handler->checkPermission($request);
		}
		// }

		$notPermittedModules = array('ModComments','Integration','DashBoard');

+1 −0

Original line number	Diff line number	Diff line
		@@ -128,6 +128,7 @@ abstract class Vtiger_Action_Controller extends Vtiger_Controller {
		if(!Users_Privileges_Model::isPermitted($moduleParameter, $permission['action'], $recordParameter)) {
		throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
		}
		if(Vtiger_Runtime::isRestricted('modules',$moduleParameter)){}
		}
		return true;
		}

+1 −0

Original line number	Diff line number	Diff line
		@@ -13,6 +13,7 @@ class Accounts_TransferOwnership_Action extends Vtiger_Action_Controller {

		public function requiresPermission(\Vtiger_Request $request) {
		$permissions = parent::requiresPermission($request);
		$permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView');
		$permissions[] = array('module_parameter' => 'module', 'action' => 'EditView', 'record_parameter' => 'record');
		return $permissions;
		}

+15 −1

Original line number	Diff line number	Diff line
		@@ -10,10 +10,24 @@

		class CustomView_Delete_Action extends Vtiger_Action_Controller {

		public function requiresPermission(\Vtiger_Request $request) {
		$permissions = parent::requiresPermission($request);
		$permissions[] = array('module_parameter' => 'sourceModule', 'action' => 'DetailView');
		return $permissions;
		}

		public function checkPermission(Vtiger_Request $request) {
		return parent::checkPermission($request);
		}

		public function process(Vtiger_Request $request) {
		$customViewModel = CustomView_Record_Model::getInstanceById($request->get('record'));
		$moduleModel = $customViewModel->getModule();

		$customViewOwner = $customViewModel->getOwnerId();
		$currentUser = Users_Record_Model::getCurrentUserModel();
		if ((!$currentUser->isAdminUser()) \|\| ($customViewOwner != $currentUser->getId())) {
		throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
		}
		$customViewModel->delete();

		$listViewUrl = $moduleModel->getListViewUrl();

+15 −1

Original line number	Diff line number	Diff line
		@@ -10,6 +10,16 @@

		class CustomView_DeleteAjax_Action extends Vtiger_Action_Controller {

		public function requiresPermission(\Vtiger_Request $request) {
		$permissions = parent::requiresPermission($request);
		$permissions[] = array('module_parameter' => 'sourceModule', 'action' => 'DetailView');
		return $permissions;
		}

		public function checkPermission(Vtiger_Request $request) {
		return parent::checkPermission($request);
		}

		function preProcess(Vtiger_Request $request) {
		return true;
		}
		@@ -20,7 +30,11 @@ class CustomView_DeleteAjax_Action extends Vtiger_Action_Controller {

		public function process(Vtiger_Request $request) {
		$customViewModel = CustomView_Record_Model::getInstanceById($request->get('record'));

		$customViewOwner = $customViewModel->getOwnerId();
		$currentUser = Users_Record_Model::getCurrentUserModel();
		if ((!$currentUser->isAdminUser()) \|\| ($customViewOwner != $currentUser->getId())) {
		throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
		}
		$customViewModel->delete();
		}