Changeset 475

Timestamp:

10/03/09 15:26:49 (15 years ago)

Author:

nanardon

Message:

• filter denied attributes in forms

File:

• LATMOS-Accounts-Web/lib/LATMOS/Accounts/Web/Model/AttrForms.pm (modified) (3 diffs)

LATMOS-Accounts-Web/lib/LATMOS/Accounts/Web/Model/AttrForms.pm

@@ -166 +166 @@
 sub attributes {
     my ($self, $for) = @_;
+    grep { $self->base->check_acl($self->{object} || $self->otype, $_, 'r') }
     grep { $self->base->get_field_name($self->otype, $_, $for || 'a') }
     @{ $forms->{$self->{form}}->{attrs} };
@@ -187 +188 @@
 sub attr_field {
     my ($self, $attr, $type) = @_;
-    $type ||= $self->base->get_field_name($self->otype, $attr, 'w')
+    $type ||= $self->base->get_field_name($self->otype, $attr, 'w') &&
+              $self->base->check_acl($self->{object} || $self->otype, $attr, 'w')
         ? $attrs->{$attr}[1] || ''
         : 'label';
@@ -258 +260 @@
                 $select .= sprintf(
                     '    <option value="%s"%s>%s</options>',
-                    $self->escape($val),
+                    $self->escape($val || ''),
                     $value eq $val ? ' "selected"' : '',
-                    $self->escape($id),
+                    $self->escape($id || ''),
                 );
                 $select .= "\n";