* Preferences: non-admin user was able to give himself run-rights to any app incl. admin

This commit is contained in:
Ralf Becker 2014-09-18 13:54:09 +00:00
parent a2d2a9e527
commit e7048d93db

View File

@ -270,8 +270,8 @@ class admin_acl
!$GLOBALS['egw']->acl->check('account_access', 64, 'admin'); // ! because this denies access! !$GLOBALS['egw']->acl->check('account_access', 64, 'admin'); // ! because this denies access!
$own_access = $admin_access || isset($GLOBALS['egw_info']['user']['apps']['preferences']); $own_access = $admin_access || isset($GLOBALS['egw_info']['user']['apps']['preferences']);
} }
if (!($location === 'run' || (int)$account_id) || if (!(int)$account_id || !((int)$account_id == (int)$GLOBALS['egw_info']['user']['account_id'] && $location !== 'run' ?
!((int)$account_id == (int)$GLOBALS['egw_info']['user']['account_id'] ? $own_access : $admin_access)) $own_access : $admin_access))
{ {
if ($throw) throw new egw_exception_no_permission(lang('Permission denied!!!')); if ($throw) throw new egw_exception_no_permission(lang('Permission denied!!!'));
return false; return false;
@ -307,6 +307,7 @@ class admin_acl
*/ */
public static function ajax_change_acl($ids, $rights=null) public static function ajax_change_acl($ids, $rights=null)
{ {
try {
foreach((array)$ids as $id) foreach((array)$ids as $id)
{ {
list($app, $account_id, $location) = explode(':', $id, 3); list($app, $account_id, $location) = explode(':', $id, 3);
@ -345,6 +346,10 @@ class admin_acl
'type' => !(int)$rights ? 'delete' : 'add', 'type' => !(int)$rights ? 'delete' : 'add',
)); ));
} }
catch (Exception $e) {
egw_json_response::get()->call('egw.message', $e->getMessage(), 'error');
}
}
/** /**
* New index page * New index page