Changeset 1569 for trunk


Ignore:
Timestamp:
12/30/15 16:57:00 (9 years ago)
Author:
nanardon
Message:

Check permission in summary* function

Location:
trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Objects.pm

    r1567 r1569  
    647647sub attributes_summary { 
    648648    my ($class, $base, $attribute) = @_; 
     649    my $attr = $base->attribute($class->type, $attribute) or do { 
     650        $base->log(LA_ERR, "Cannot instantiate %s attribute", $attribute); 
     651        return; 
     652    }; 
     653    if (!$attr->readable) { 
     654        $base->log(LA_WARN, l('Attribute %s is not readable', $attribute)); 
     655        return; 
     656    } 
     657    if (!$base->check_acl($class->type, $attribute, 'r')) { 
     658        $base->log(LA_WARN, l('Permission denied to read attribute %s', $attribute)); 
     659        return; 
     660    } 
    649661    my %values; 
    650662    foreach my $id ($base->list_objects($class->type)) { 
    … …  
    672684sub attributes_summary_by_object { 
    673685    my ($class, $base, $attribute) = @_; 
     686    my $attr = $base->attribute($class->type, $attribute) or do { 
     687        $base->log(LA_ERR, "Cannot instantiate %s attribute", $attribute); 
     688        return; 
     689    }; 
     690    if (!$attr->readable) { 
     691        $base->log(LA_WARN, l('Attribute %s is not readable', $attribute)); 
     692        return; 
     693    } 
     694    if (!$base->check_acl($class->type, $attribute, 'r')) { 
     695        $base->log(LA_WARN, l('Permission denied to read attribute %s', $attribute)); 
     696        return; 
     697    } 
    674698    my %values; 
    675699    foreach my $id ($base->list_objects($class->type)) { 

  • trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Sql/objects.pm

    r1551 r1569  
    618618sub attributes_summary { 
    619619    my ($class, $base, $attribute) = @_; 
    620     my $attr = $base->attribute($class->type, $attribute); 
     620    my $attr = $base->attribute($class->type, $attribute) or do { 
     621        $base->log(LA_ERR, "Cannot instantiate %s attribute", $attribute); 
     622        return; 
     623    }; 
     624    if (!$attr->readable) { 
     625        $base->log(LA_WARN, l('Attribute %s is not readable', $attribute)); 
     626        return; 
     627    } 
     628    if (!$base->check_acl($class->type, $attribute, 'r')) { 
     629        $base->log(LA_WARN, l('Permission denied to read attribute %s', $attribute)); 
     630        return; 
     631    } 
    621632    if ($attr->{managed}) {  
    622633        return $class->SUPER::attributes_summary($base, $attribute); 
    … …  
    661672        return; 
    662673    }; 
     674    if (!$attr->readable) { 
     675        $base->log(LA_WARN, l('Attribute %s is not readable', $attribute)); 
     676        return; 
     677    } 
     678    if (!$base->check_acl($class->type, $attribute, 'r')) { 
     679        $base->log(LA_WARN, l('Permission denied to read attribute %s', $attribute)); 
     680        return; 
     681    } 
    663682    if ($attr->{managed}) { 
    664683        return $class->SUPER::attributes_summary_by_object($base, $attribute); 
    … …  
    686705    my %values; 
    687706    while (my $res = $sth->fetchrow_hashref) { 
     707        defined($res->{value}) or next; 
    688708        push(@{ $values{ $res->{name} } }, $res->{value}); 
    689709    } 
Note: See TracChangeset for help on using the changeset viewer.