Merge pull request #58 from catalyst/fix-missing-canview-check

FIX: add missing canView check in json
This commit is contained in:
Robbie Averill 2018-04-09 11:34:20 +12:00 committed by GitHub
commit 3c1055e2f0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -106,6 +106,9 @@ class JSONDataFormatter extends DataFormatter
if ($this->customRelations && !in_array($relName, $this->customRelations)) {
continue;
}
if ($obj->$relName() && (!$obj->$relName()->exists() || !$obj->$relName()->canView())) {
continue;
}
$fieldName = $relName . 'ID';
$rel = $this->config()->api_base;
@ -140,6 +143,9 @@ class JSONDataFormatter extends DataFormatter
$innerParts = array();
$items = $obj->$relName();
foreach ($items as $item) {
if (!$item->canView()) {
continue;
}
$rel = $this->config()->api_base . $this->sanitiseClassName($relClass) . "/$item->ID";
$href = Director::absoluteURL($rel);
$innerParts[] = ArrayData::array_to_object(array(