From 962b3d2248a6ebce1ddd1bdac93cf539d45915c1 Mon Sep 17 00:00:00 2001
From: Daniel Barbero Martin <daniel.barbero@artica.es>
Date: Tue, 11 Feb 2020 09:45:43 +0100
Subject: [PATCH] Fix linked ACL another VC

---
 .../include/rest-api/models/VisualConsole/Item.php  | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pandora_console/include/rest-api/models/VisualConsole/Item.php b/pandora_console/include/rest-api/models/VisualConsole/Item.php
index 2c35b3b79f..2cb365f3f7 100644
--- a/pandora_console/include/rest-api/models/VisualConsole/Item.php
+++ b/pandora_console/include/rest-api/models/VisualConsole/Item.php
@@ -1052,6 +1052,19 @@ class Item extends CachedModel
             // The layout can be from another node.
             $linkedLayoutNodeId = $linkedVisualConsole['linkedLayoutNodeId'];
 
+            // Check ACL.
+            $visualConsole = VC::fromDB(['id' => $vcId]);
+            $visualConsoleData = $visualConsole->toArray();
+            $vcGroupId = $visualConsoleData['groupId'];
+
+            $aclRead = \check_acl($config['id_user'], $vcGroupId, 'VR');
+            // To build the link to another visual console
+            // you must have read permissions of the visual console
+            // with which it is linked.
+            if ($aclRead === 0) {
+                return null;
+            }
+
             if (empty($linkedLayoutNodeId) === true && \is_metaconsole()) {
                 /*
                  * A Visual Console from this console.