redmine_plugins/redmine_dmsf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

File view permissions issue

Browse Source 
#1434
This commit is contained in:
Karel Pičman 2023-03-23 10:54:09 +01:00
parent 3d42e71f1a
commit 2b73e59c8f
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/dmsf_files_controller.rb
View File

@ -43,7 +43,7 @@ class DmsfFilesController < ApplicationController
def permissions def permissions
if @file if @file
render_403 unless DmsfFolder.permissions?(@file.dmsf_folder) render_403 unless DmsfFolder.permissions?(@file.dmsf_folder, true, true)
end end
true true
end end

5
app/models/dmsf_folder.rb
View File

@ -107,11 +107,12 @@ class DmsfFolder < ActiveRecord::Base
true true
end end
def self.permissions?(folder, allow_system = true) def self.permissions?(folder, allow_system = true, file = false)
# Administrator? # Administrator?
return true if (User.current&.admin? || folder.nil?) return true if (User.current&.admin? || folder.nil?)
# Permissions to the project? # Permissions to the project?
return false unless User.current&.allowed_to?(:view_dmsf_folders, folder.project) # If file is true we work just with the file and not viewing the folder
return false unless file || User.current&.allowed_to?(:view_dmsf_folders, folder.project)
# System folder? # System folder?
if folder && folder.system if folder && folder.system
return false unless allow_system || User.current.allowed_to?(:display_system_folders, folder.project) return false unless allow_system || User.current.allowed_to?(:display_system_folders, folder.project)