Fix permission condition

This commit is contained in:
Dennis Eichhorn 2017-09-16 11:47:52 +02:00
parent 49d9b27863
commit 346006f684

View File

@ -183,8 +183,8 @@ class Controller extends ModuleAbstract implements WebInterface
$doc = EditorDocMapper::get((int) $request->getData('id')); $doc = EditorDocMapper::get((int) $request->getData('id'));
$accountId = $request->getHeader()->getAccount(); $accountId = $request->getHeader()->getAccount();
if (!$doc->getCreatedBy()->getId() === $accountId if ($doc->getCreatedBy()->getId() !== $accountId
|| !$this->app->accountManager->get($accountId)->hasPermission( && !$this->app->accountManager->get($accountId)->hasPermission(
PermissionType::READ, 1, $this->app->appName, self::MODULE_ID, PermissionState::DOC, $doc->getId()) PermissionType::READ, 1, $this->app->appName, self::MODULE_ID, PermissionState::DOC, $doc->getId())
) { ) {
$view->setTemplate('/Web/Backend/Error/403_inline'); $view->setTemplate('/Web/Backend/Error/403_inline');