tonyair/silverstripe-restfulserver
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-restfulserver synced 2024-10-22 14:05:58 +02:00
Code Issues Projects Releases Wiki Activity

FIX: add missing canView check in json

Browse Source
This commit is contained in:
Andreas Piening 2018-04-09 11:20:34 +12:00
parent bb000254af
commit d0149f8995
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/DataFormatter/JSONDataFormatter.php
View File

@ -106,6 +106,9 @@ class JSONDataFormatter extends DataFormatter
if ($this->customRelations && !in_array($relName, $this->customRelations)) { if ($this->customRelations && !in_array($relName, $this->customRelations)) {
continue; continue;
} }
if ($obj->$relName() && (!$obj->$relName()->exists() || !$obj->$relName()->canView())) {
continue;
}
$fieldName = $relName . 'ID'; $fieldName = $relName . 'ID';
$rel = $this->config()->api_base; $rel = $this->config()->api_base;
@ -140,6 +143,7 @@ class JSONDataFormatter extends DataFormatter
$innerParts = array(); $innerParts = array();
$items = $obj->$relName(); $items = $obj->$relName();
foreach ($items as $item) { foreach ($items as $item) {
if (!$item->canView()) continue;
$rel = $this->config()->api_base . $this->sanitiseClassName($relClass) . "/$item->ID"; $rel = $this->config()->api_base . $this->sanitiseClassName($relClass) . "/$item->ID";
$href = Director::absoluteURL($rel); $href = Director::absoluteURL($rel);
$innerParts[] = ArrayData::array_to_object(array( $innerParts[] = ArrayData::array_to_object(array(