zikula-modules / mediaattach Goto Github PK
View Code? Open in Web Editor NEWMediaAttach is a media and file management module providing several different hooks and powerful means for content integration.
MediaAttach is a media and file management module providing several different hooks and powerful means for content integration.
Parameters in several calls to checkPermission() contain a blank at the end. This might cause wrong permission evaluation. Affected functions and files are:
MediaAttach_ajax_performupload (pnajax.php)
MediaAttach_admin_view (pnadmin/view.php)
MediaAttach_external_finditem (pnexternal/finditem.php)
MediaAttach_user_createuploadflash (pnuser/createuploadflash.php)
MediaAttach_user_createupload (pnuser/createupload.php)
MediaAttach_user_createextvid (pnuser/createextvid.php)
MediaAttach_user_showfileliste (pnuser/showfileliste.php)
MediaAttach_user_viewupload (pnuser/viewupload.php)
mediaattachItemSelector::render (pntemplates\pnform\function.mediaattachitemselector.php)
On our web server we have serveral news articles with attached uploads. But some of the uploads shall only be visible to users logged in while other uploads shall be publically visible.
The permission schema 'Module:Item ID:Upload ID' seems to fulfull this by addressing the upload IDs. But this does noc work.
In MediaAttach_userapi_getalluploads() a permission filter is passed to DBUtil::selectExpandedObjectArray(). But additionally general read permission to all MediaAttach items and uploads is checked at the beginning of the funktion. With this check the permission filter will have no effect.
I removed the permission check at the beginning of the function. Now it is possible to deny access to individual uploads and afterwards allow access to al uploads of an item.
Example:
MediaAttach:: | News:146:(389|390) | NONE
MediaAttach:: | News:146: | READ
When MediaAttach 1.1.0.0 is hooked to another module (e.g. News) and a user has permission to view the module contents but has no persionn to view attached files too, the whole page will not be displayed. Instead the request is redirected to the login screen.
The function MediaAttach_user_showfilelist in pnuser/showfilelist.php (MediaAttach 1.1.0.0) always returns with LogUtil::registerPermissionError(), when checkPermission() fails. Other hook modules return empty content, if called as a hook.
MediaAttach should do so too, i.e. check if the GUI function was called as a hook ($objectid != '') and then return empty content (return false) rather than call LogUtil::registerPermissionError().
Regards
Reiner
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.