tonyair/silverstripe-restfulserver
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-restfulserver synced 2024-10-22 14:05:58 +02:00
Code Issues Projects Releases Wiki Activity

Merge pull request #58 from catalyst/fix-missing-canview-check

Browse Source 
FIX: add missing canView check in json
This commit is contained in:
Robbie Averill 2018-04-09 11:34:20 +12:00 committed by GitHub
commit 3c1055e2f0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/DataFormatter/JSONDataFormatter.php
View File

@ -106,6 +106,9 @@ class JSONDataFormatter extends DataFormatter
if ($this->customRelations && !in_array($relName, $this->customRelations)) { if ($this->customRelations && !in_array($relName, $this->customRelations)) {
continue; continue;
} }
if ($obj->$relName() && (!$obj->$relName()->exists() || !$obj->$relName()->canView())) {
continue;
}
$fieldName = $relName . 'ID'; $fieldName = $relName . 'ID';
$rel = $this->config()->api_base; $rel = $this->config()->api_base;
@ -140,6 +143,9 @@ class JSONDataFormatter extends DataFormatter
$innerParts = array(); $innerParts = array();
$items = $obj->$relName(); $items = $obj->$relName();
foreach ($items as $item) { foreach ($items as $item) {
if (!$item->canView()) {
continue;
}
$rel = $this->config()->api_base . $this->sanitiseClassName($relClass) . "/$item->ID"; $rel = $this->config()->api_base . $this->sanitiseClassName($relClass) . "/$item->ID";
$href = Director::absoluteURL($rel); $href = Director::absoluteURL($rel);
$innerParts[] = ArrayData::array_to_object(array( $innerParts[] = ArrayData::array_to_object(array(