tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-01 13:48:37 +02:00
Code Issues Projects Releases Wiki Activity

BUGFIX: Don't let non ADMINs with permission-editing rights assign themselves ADMIN permissions. (from r89805)

Browse Source 
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/branches/2.4@96718 467b73ca-7a2a-4603-9d3b-597d59a354a9
This commit is contained in:
Sam Minnee 2010-01-12 22:53:52 +00:00
parent ad20ff2ac0
commit 150457f8a2
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
security/Permission.php
View File

@ -488,7 +488,7 @@ class Permission extends DataObject {
'help' => null,
'sort' => 100000
);
if($classes) foreach($classes as $class) {
$SNG = singleton($class);
if($SNG instanceof TestOnly) continue;
@ -532,6 +532,9 @@ class Permission extends DataObject {
'sort' => 0
);
}
// Don't let people hijack ADMIN rights
if(!Permission::check("ADMIN")) unset($allCodes['ADMIN']);
ksort($allCodes);