From 962b3d2248a6ebce1ddd1bdac93cf539d45915c1 Mon Sep 17 00:00:00 2001 From: Daniel Barbero Martin Date: Tue, 11 Feb 2020 09:45:43 +0100 Subject: [PATCH] Fix linked ACL another VC --- .../include/rest-api/models/VisualConsole/Item.php | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/pandora_console/include/rest-api/models/VisualConsole/Item.php b/pandora_console/include/rest-api/models/VisualConsole/Item.php index 2c35b3b79f..2cb365f3f7 100644 --- a/pandora_console/include/rest-api/models/VisualConsole/Item.php +++ b/pandora_console/include/rest-api/models/VisualConsole/Item.php @@ -1052,6 +1052,19 @@ class Item extends CachedModel // The layout can be from another node. $linkedLayoutNodeId = $linkedVisualConsole['linkedLayoutNodeId']; + // Check ACL. + $visualConsole = VC::fromDB(['id' => $vcId]); + $visualConsoleData = $visualConsole->toArray(); + $vcGroupId = $visualConsoleData['groupId']; + + $aclRead = \check_acl($config['id_user'], $vcGroupId, 'VR'); + // To build the link to another visual console + // you must have read permissions of the visual console + // with which it is linked. + if ($aclRead === 0) { + return null; + } + if (empty($linkedLayoutNodeId) === true && \is_metaconsole()) { /* * A Visual Console from this console.