Fix permission condition

This commit is contained in:
Dennis Eichhorn 2017-09-16 11:47:52 +02:00
parent 49d9b27863
commit 346006f684

View File

@ -183,8 +183,8 @@ class Controller extends ModuleAbstract implements WebInterface
$doc = EditorDocMapper::get((int) $request->getData('id'));
$accountId = $request->getHeader()->getAccount();
if (!$doc->getCreatedBy()->getId() === $accountId
|| !$this->app->accountManager->get($accountId)->hasPermission(
if ($doc->getCreatedBy()->getId() !== $accountId
&& !$this->app->accountManager->get($accountId)->hasPermission(
PermissionType::READ, 1, $this->app->appName, self::MODULE_ID, PermissionState::DOC, $doc->getId())
) {
$view->setTemplate('/Web/Backend/Error/403_inline');