tonyair
/
silverstripe-restfulserver
mirror of https://github.com/silverstripe/silverstripe-restfulserver
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #58 from catalyst/fix-missing-canview-check 

FIX: add missing canView check in json
This commit is contained in:
Robbie Averill 2018-04-09 11:34:20 +12:00 committed by GitHub
parent f54142e661 cbca821c9b
commit 3c1055e2f0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/DataFormatter/JSONDataFormatter.php
View File

@ -106,6 +106,9 @@ class JSONDataFormatter extends DataFormatter
if ($this->customRelations && !in_array($relName, $this->customRelations)) {
continue;
}
if ($obj->$relName() && (!$obj->$relName()->exists() || !$obj->$relName()->canView())) {
continue;
}
$fieldName = $relName . 'ID';
$rel = $this->config()->api_base;
@ -140,6 +143,9 @@ class JSONDataFormatter extends DataFormatter
$innerParts = array();
$items = $obj->$relName();
foreach ($items as $item) {
if (!$item->canView()) {
continue;
}
$rel = $this->config()->api_base . $this->sanitiseClassName($relClass) . "/$item->ID";
$href = Director::absoluteURL($rel);
$innerParts[] = ArrayData::array_to_object(array(