Changeset 1569 for trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Objects.pm

Timestamp:

12/30/15 16:57:00 (8 years ago)

Author:

nanardon

Message:

Check permission in summary* function

File:

• trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Objects.pm (modified) (2 diffs)

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Objects.pm

@@ -647 +647 @@
 sub attributes_summary {
     my ($class, $base, $attribute) = @_;
+    my $attr = $base->attribute($class->type, $attribute) or do {
+        $base->log(LA_ERR, "Cannot instantiate %s attribute", $attribute);
+        return;
+    };
+    if (!$attr->readable) {
+        $base->log(LA_WARN, l('Attribute %s is not readable', $attribute));
+        return;
+    }
+    if (!$base->check_acl($class->type, $attribute, 'r')) {
+        $base->log(LA_WARN, l('Permission denied to read attribute %s', $attribute));
+        return;
+    }
     my %values;
     foreach my $id ($base->list_objects($class->type)) {
@@ -672 +684 @@
 sub attributes_summary_by_object {
     my ($class, $base, $attribute) = @_;
+    my $attr = $base->attribute($class->type, $attribute) or do {
+        $base->log(LA_ERR, "Cannot instantiate %s attribute", $attribute);
+        return;
+    };
+    if (!$attr->readable) {
+        $base->log(LA_WARN, l('Attribute %s is not readable', $attribute));
+        return;
+    }
+    if (!$base->check_acl($class->type, $attribute, 'r')) {
+        $base->log(LA_WARN, l('Permission denied to read attribute %s', $attribute));
+        return;
+    }
     my %values;
     foreach my $id ($base->list_objects($class->type)) {