webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-06-13 00:41:59 +03:00
Code Activity

Merge pull request #3632 from BookStackApp/ownable_permission_fix

Browse Source 
Fixed failed permission checks due to non-loaded fields
This commit is contained in:
Dan Brown
2022-08-10 17:59:46 +01:00
committed by GitHub
parent 031c67ba58 16eedc8264
commit 375abca1ee
6 changed files with 42 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/Http/Controllers/FavouriteController.php
View File

@ -87,7 +87,7 @@ class FavouriteController extends Controller
$modelInstance = $model->newQuery()
->where('id', '=', $modelInfo['id'])
->first(['id', 'name']);
->first(['id', 'name', 'restricted', 'owned_by']);
$inaccessibleEntity = ($modelInstance instanceof Entity && !userCan('view', $modelInstance));
if (is_null($modelInstance) || $inaccessibleEntity) {