oqapi/webgui
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

www_editSave needs permission checks to prevent extra assets from being added by unprivileged users. Partial fix for #12068.

Browse source
This commit is contained in:
Colin Kuskie 2011-03-07 15:59:31 -08:00
parent 78d27ad031
commit efcc4fe1a7
2 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/changelog/7.x.x.txt
View file

@ -8,6 +8,7 @@
- fixed #12061: TimeField form plugin doesn't work with all names. - fixed #12061: TimeField form plugin doesn't work with all names.
- fixed #12055: Thingy pagination breaks after editing data - fixed #12055: Thingy pagination breaks after editing data
- fixed #12066: Thingy CSV export overrides ExportHTML - fixed #12066: Thingy CSV export overrides ExportHTML
- fixed #12068: www_editSave not strict enough in permission checks
7.10.10 7.10.10
- fixed #12035: Story Manager - make keywords from Story view work - fixed #12035: Story Manager - make keywords from Story view work

9
lib/WebGUI/Asset.pm
View file

@ -2997,6 +2997,11 @@ sub www_editSave {
##If this is a new asset (www_add), the parent may be locked. We should still be able to add a new asset. ##If this is a new asset (www_add), the parent may be locked. We should still be able to add a new asset.
my $isNewAsset = $session->form->process("assetId") eq "new" ? 1 : 0; my $isNewAsset = $session->form->process("assetId") eq "new" ? 1 : 0;
$session->log->warn("new asset: $isNewAsset");
$session->log->warn("canEdit: ". $self->canEdit);
$session->log->warn("validToken: ". $session->form->validToken);
$session->log->warn("userId: ". $session->user->userId);
$session->log->warn("ownerUserId: ". $self->get('ownerUserId'));
return $session->privilege->locked() if (!$self->canEditIfLocked and !$isNewAsset); return $session->privilege->locked() if (!$self->canEditIfLocked and !$isNewAsset);
return $session->privilege->insufficient() unless $self->canEdit && $session->form->validToken; return $session->privilege->insufficient() unless $self->canEdit && $session->form->validToken;
if ($self->session->config->get("maximumAssets")) { if ($self->session->config->get("maximumAssets")) {
@ -3006,7 +3011,9 @@ sub www_editSave {
} }
my $object; my $object;
if ($isNewAsset) { if ($isNewAsset) {
$object = $self->addChild({className=>$session->form->process("class","className")}); my $className = $session->form->process("class","className");
return $session->privilege->insufficient() if ($isNewAsset && !$className->canAdd($session));
$object = $self->addChild({className=> $className});
return $self->www_view unless defined $object; return $self->www_view unless defined $object;
$object->{_parent} = $self; $object->{_parent} = $self;
$object->{_properties}{url} = undef; $object->{_properties}{url} = undef;