Mirrors/Part-DB-server
2
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-03-04 22:45:56 +01:00
Code Issues Packages Projects Releases Wiki Activity

Added a permission to control which users can access private attachments.

Browse Source
This commit is contained in:
Jan Böhmer
2020-03-30 16:56:58 +02:00
parent 9769915b34
commit e83d72ec10
7 changed files with 31 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/Controller/AttachmentFileController.php
View File

@@ -69,6 +69,10 @@ class AttachmentFileController extends AbstractController
{
$this->denyAccessUnlessGranted('read', $attachment);
if ($attachment->isSecure()) {
$this->denyAccessUnlessGranted('show_private', $attachment);
}
if ($attachment->isExternal()) {
throw new RuntimeException('You can not download external attachments!');
}
@@ -97,6 +101,10 @@ class AttachmentFileController extends AbstractController
{
$this->denyAccessUnlessGranted('read', $attachment);
if ($attachment->isSecure()) {
$this->denyAccessUnlessGranted('show_private', $attachment);
}
if ($attachment->isExternal()) {
throw new RuntimeException('You can not download external attachments!');
}