From b71a521c21bb15a5dde007088741bb0c567a8553 Mon Sep 17 00:00:00 2001 From: Stephen Shkardoon Date: Thu, 21 May 2015 20:51:07 +1200 Subject: [PATCH] Fix incorrect permission check on duplicate() Will now properly fall back to the canCreate() on the parent --- code/controllers/CMSMain.php | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/code/controllers/CMSMain.php b/code/controllers/CMSMain.php index f5225cbd..ad3311f8 100644 --- a/code/controllers/CMSMain.php +++ b/code/controllers/CMSMain.php @@ -1316,7 +1316,9 @@ class CMSMain extends LeftAndMain implements CurrentPageIdentifier, PermissionPr if(($id = $this->urlParams['ID']) && is_numeric($id)) { $page = DataObject::get_by_id("SiteTree", $id); - if($page && (!$page->canEdit() || !$page->canCreate())) return Security::permissionFailure($this); + if($page && (!$page->canEdit() || !$page->canCreate(null, array('Parent' => $page->Parent())))) { + return Security::permissionFailure($this); + } if(!$page || !$page->ID) throw new SS_HTTPResponse_Exception("Bad record ID #$id", 404); $newPage = $page->duplicate(); @@ -1352,7 +1354,9 @@ class CMSMain extends LeftAndMain implements CurrentPageIdentifier, PermissionPr increase_time_limit_to(); if(($id = $this->urlParams['ID']) && is_numeric($id)) { $page = DataObject::get_by_id("SiteTree", $id); - if($page && (!$page->canEdit() || !$page->canCreate())) return Security::permissionFailure($this); + if($page && (!$page->canEdit() || !$page->canCreate(null, array('Parent' => $page->Parent())))) { + return Security::permissionFailure($this); + } if(!$page || !$page->ID) throw new SS_HTTPResponse_Exception("Bad record ID #$id", 404); $newPage = $page->duplicateWithChildren();