webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-07-28 17:02:04 +03:00
Code Activity

Fixed failed permission checks due to non-loaded fields

Browse Source 
Added additional exceptions to prevent such cases in the future, so
that they are caught in dev ideally.
Added test case specifically for reported favourite scenario.
This commit is contained in:
Dan Brown
2022-08-10 08:06:48 +01:00
parent 219da9da9b
commit 16eedc8264
6 changed files with 42 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/Http/Controllers/FavouriteController.php
View File

@ -87,7 +87,7 @@ class FavouriteController extends Controller
$modelInstance = $model->newQuery()
->where('id', '=', $modelInfo['id'])
->first(['id', 'name']);
->first(['id', 'name', 'restricted', 'owned_by']);
$inaccessibleEntity = ($modelInstance instanceof Entity && !userCan('view', $modelInstance));
if (is_null($modelInstance) || $inaccessibleEntity) {