oqapi/webgui
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

www_editSave needs permission checks to prevent extra assets from being added by unprivileged users. Partial fix for #12068.

Browse source
This commit is contained in:
Colin Kuskie 2011-03-07 15:59:31 -08:00
parent 78d27ad031
commit efcc4fe1a7
2 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
lib/WebGUI/Asset.pm
View file

@ -2997,6 +2997,11 @@ sub www_editSave {
##If this is a new asset (www_add), the parent may be locked. We should still be able to add a new asset.
my $isNewAsset = $session->form->process("assetId") eq "new" ? 1 : 0;
$session->log->warn("new asset: $isNewAsset");
$session->log->warn("canEdit: ". $self->canEdit);
$session->log->warn("validToken: ". $session->form->validToken);
$session->log->warn("userId: ". $session->user->userId);
$session->log->warn("ownerUserId: ". $self->get('ownerUserId'));
return $session->privilege->locked() if (!$self->canEditIfLocked and !$isNewAsset);
return $session->privilege->insufficient() unless $self->canEdit && $session->form->validToken;
if ($self->session->config->get("maximumAssets")) {
@ -3006,7 +3011,9 @@ sub www_editSave {
}
my $object;
if ($isNewAsset) {
$object = $self->addChild({className=>$session->form->process("class","className")});
my $className = $session->form->process("class","className");
return $session->privilege->insufficient() if ($isNewAsset && !$className->canAdd($session));
$object = $self->addChild({className=> $className});
return $self->www_view unless defined $object;
$object->{_parent} = $self;
$object->{_properties}{url} = undef;