oqapi/webgui
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merging 6.8.7 security fixes

Browse source
This commit is contained in:
Roy Johnson 2006-02-23 02:40:58 +00:00
parent b32a94d4d0
commit 3530c41e7d
3 changed files with 22 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/WebGUI/AssetBranch.pm
View file

@ -272,7 +272,7 @@ Verifies proper inputs in the Asset Tree and saves them. Returns ManageAssets me
sub www_editBranchSave {
my $self = shift;
return $self->session->privilege->insufficient() unless ($self->canEdit);
return $self->session->privilege->insufficient() unless ($self->canEdit && WebGUI::Grouping::isInGroup('4'));
my %data;
$data{isHidden} = $self->session->form->yesNo("isHidden") if ($self->session->form->yesNo("change_isHidden"));
$data{newWindow} = $self->session->form->yesNo("newWindow") if ($self->session->form->yesNo("change_newWindow"));
@ -297,6 +297,7 @@ sub www_editBranchSave {
}
my $descendants = $self->getLineage(["self","descendants"],{returnObjects=>1});
foreach my $descendant (@{$descendants}) {
next unless $descendant->canEdit;
my $url;
if ($changeUrl) {
if ($urlBaseBy eq "parentUrl") {

10
lib/WebGUI/AssetPackage.pm
View file

@ -81,10 +81,16 @@ Returns "". Deploys a Package. If canEdit is Fales, renders an insufficient Priv
sub www_deployPackage {
my $self = shift;
return $self->session->privilege->insufficient() unless $self->canEdit;
my $packageMasterAssetId = $self->session->form->process("assetId");
# Must have edit rights to the asset deploying the package. Also, must be a Content Manager.
# This protects against non content managers deploying packages using a post or similar trickery.
return $self->session->privilege->insufficient() unless ($self->canEdit && WebGUI::Grouping::isInGroup('4'));
my $packageMasterAssetId = $session{form}{assetId};
if (defined $packageMasterAssetId) {
my $packageMasterAsset = WebGUI::Asset->newByDynamicClass($packageMasterAssetId);
unless ($packageMasterAsset->getValue('isPackage')) { #only deploy packages
WebGUI::ErrorHandler::security('deploy an asset as a package which was not set as a package.');
return;
}
my $masterLineage = $packageMasterAsset->get("lineage");
if (defined $packageMasterAsset && $packageMasterAsset->canView && $self->get("lineage") !~ /^$masterLineage/) {
my $deployedTreeMaster = $self->duplicateBranch($packageMasterAsset);