forked from extern/egroupware
* Preferences: non-admin user was able to give himself run-rights to any app incl. admin
This commit is contained in:
parent
a2d2a9e527
commit
e7048d93db
@ -270,8 +270,8 @@ class admin_acl
|
|||||||
!$GLOBALS['egw']->acl->check('account_access', 64, 'admin'); // ! because this denies access!
|
!$GLOBALS['egw']->acl->check('account_access', 64, 'admin'); // ! because this denies access!
|
||||||
$own_access = $admin_access || isset($GLOBALS['egw_info']['user']['apps']['preferences']);
|
$own_access = $admin_access || isset($GLOBALS['egw_info']['user']['apps']['preferences']);
|
||||||
}
|
}
|
||||||
if (!($location === 'run' || (int)$account_id) ||
|
if (!(int)$account_id || !((int)$account_id == (int)$GLOBALS['egw_info']['user']['account_id'] && $location !== 'run' ?
|
||||||
!((int)$account_id == (int)$GLOBALS['egw_info']['user']['account_id'] ? $own_access : $admin_access))
|
$own_access : $admin_access))
|
||||||
{
|
{
|
||||||
if ($throw) throw new egw_exception_no_permission(lang('Permission denied!!!'));
|
if ($throw) throw new egw_exception_no_permission(lang('Permission denied!!!'));
|
||||||
return false;
|
return false;
|
||||||
@ -307,6 +307,7 @@ class admin_acl
|
|||||||
*/
|
*/
|
||||||
public static function ajax_change_acl($ids, $rights=null)
|
public static function ajax_change_acl($ids, $rights=null)
|
||||||
{
|
{
|
||||||
|
try {
|
||||||
foreach((array)$ids as $id)
|
foreach((array)$ids as $id)
|
||||||
{
|
{
|
||||||
list($app, $account_id, $location) = explode(':', $id, 3);
|
list($app, $account_id, $location) = explode(':', $id, 3);
|
||||||
@ -345,6 +346,10 @@ class admin_acl
|
|||||||
'type' => !(int)$rights ? 'delete' : 'add',
|
'type' => !(int)$rights ? 'delete' : 'add',
|
||||||
));
|
));
|
||||||
}
|
}
|
||||||
|
catch (Exception $e) {
|
||||||
|
egw_json_response::get()->call('egw.message', $e->getMessage(), 'error');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* New index page
|
* New index page
|
||||||
|
Loading…
Reference in New Issue
Block a user