Fix permission condition

This commit is contained in:
Dennis Eichhorn 2017-09-16 11:47:52 +02:00
parent 6d1d7dd84f
commit d632f87927

View File

@ -154,8 +154,8 @@ class Controller extends ModuleAbstract implements WebInterface
$draw = DrawImageMapper::get($request->getData('id'));
$accountId = $request->getHeader()->getAccount();
if (!$draw->getCreatedBy()->getId() === $accountId
|| !$this->app->accountManager->get($accountId)->hasPermission(
if ($draw->getCreatedBy()->getId() !== $accountId
&& !$this->app->accountManager->get($accountId)->hasPermission(
PermissionType::READ, 1, $this->app->appName, self::MODULE_ID, PermissionState::DRAW, $draw->getId())
) {
$view->setTemplate('/Web/Backend/Error/403_inline');