tonyair
/
silverstripe-reports
mirror of https://github.com/silverstripe/silverstripe-reports
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

[SS-2016-012] FIX Missing ACL check on ReportAdmin 

This issue exposed reports to users able to guess the URL of a Report that they were not allowed to view the report
This commit is contained in:
Daniel Hensby 2016-07-14 16:57:16 +01:00 committed by Damian Mooyman
parent f17fad179f
commit c1525c8ba6
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
code/ReportAdmin.php
View File

@ -34,10 +34,12 @@ class ReportAdmin extends LeftAndMain implements PermissionProvider {
*/
protected $reportClass;
/**
* @var SS_Report
*/
protected $reportObject;
public function init() {
parent::init();
//set the report we are currently viewing from the URL
$this->reportClass = (isset($this->urlParams['ReportClass']) && $this->urlParams['ReportClass'] !== 'index')
@ -46,6 +48,8 @@ class ReportAdmin extends LeftAndMain implements PermissionProvider {
$allReports = SS_Report::get_reports();
$this->reportObject = (isset($allReports[$this->reportClass])) ? $allReports[$this->reportClass] : null;
parent::init();
// Set custom options for TinyMCE specific to ReportAdmin
HtmlEditorConfig::get('cms')->setOption('content_css', project() . '/css/editor.css');
HtmlEditorConfig::get('cms')->setOption('Lang', i18n::get_tinymce_lang());
@ -69,7 +73,8 @@ class ReportAdmin extends LeftAndMain implements PermissionProvider {
if(!parent::canView($member)) return false;
$hasViewableSubclasses = false;
if ($this->reportObject) return $this->reportObject->canView($member);
foreach($this->Reports() as $report) {
if($report->canView($member)) return true;
}