webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-08-07 23:03:00 +03:00
Code Activity

Notifications: Fixed send content permission checking

Browse Source 
Added test and changed logic to properly check the view permissions for
the notification receiver before sending.
Required change to permissions applicator to allow the user to be
manually determined, and a service provider update to provide the class
as a singleton without a specific user, so it checks the current logged
in user on demand.
This commit is contained in:
Dan Brown
2023-08-17 17:57:31 +01:00
parent ee9e342b58
commit 38829f8a38
5 changed files with 31 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
app/Activity/Notifications/Handlers/BaseNotificationHandler.php
View File

@@ -10,11 +10,6 @@ use BookStack\Users\Models\User;
abstract class BaseNotificationHandler implements NotificationHandler
{
public function __construct(
protected PermissionApplicator $permissionApplicator
) {
}
/**
* @param class-string<BaseActivityNotification> $notification
* @param int[] $userIds
@@ -35,7 +30,8 @@ abstract class BaseNotificationHandler implements NotificationHandler
}
// Prevent sending if the user does not have access to the related content
if (!$this->permissionApplicator->checkOwnableUserAccess($relatedModel, 'view')) {
$permissions = new PermissionApplicator($user);
if (!$permissions->checkOwnableUserAccess($relatedModel, 'view')) {
continue;
}