zikula-modules / mediaattach Goto Github PK

Parameters in several calls to checkPermission() contain a blank at the end. This might cause wrong permission evaluation. Affected functions and files are:

MediaAttach_ajax_performupload (pnajax.php)
MediaAttach_admin_view (pnadmin/view.php)
MediaAttach_external_finditem (pnexternal/finditem.php)
MediaAttach_user_createuploadflash (pnuser/createuploadflash.php)
MediaAttach_user_createupload (pnuser/createupload.php)
MediaAttach_user_createextvid (pnuser/createextvid.php)
MediaAttach_user_showfileliste (pnuser/showfileliste.php)
MediaAttach_user_viewupload (pnuser/viewupload.php)
mediaattachItemSelector::render (pntemplates\pnform\function.mediaattachitemselector.php)

On our web server we have serveral news articles with attached uploads. But some of the uploads shall only be visible to users logged in while other uploads shall be publically visible.

The permission schema 'Module:Item ID:Upload ID' seems to fulfull this by addressing the upload IDs. But this does noc work.

In MediaAttach_userapi_getalluploads() a permission filter is passed to DBUtil::selectExpandedObjectArray(). But additionally general read permission to all MediaAttach items and uploads is checked at the beginning of the funktion. With this check the permission filter will have no effect.

I removed the permission check at the beginning of the function. Now it is possible to deny access to individual uploads and afterwards allow access to al uploads of an item.

Example:
MediaAttach:: | News:146:(389|390) | NONE
MediaAttach:: | News:146: | READ

When MediaAttach 1.1.0.0 is hooked to another module (e.g. News) and a user has permission to view the module contents but has no persionn to view attached files too, the whole page will not be displayed. Instead the request is redirected to the login screen.

The function MediaAttach_user_showfilelist in pnuser/showfilelist.php (MediaAttach 1.1.0.0) always returns with LogUtil::registerPermissionError(), when checkPermission() fails. Other hook modules return empty content, if called as a hook.

MediaAttach should do so too, i.e. check if the GUI function was called as a hook ($objectid != '') and then return empty content (return false) rather than call LogUtil::registerPermissionError().

Regards
Reiner