makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-28 22:28:51 +00:00
Code Issues Projects Releases Packages Wiki Activity

[ticket/13779] Set new auth options to the role only if matching the role type

Browse source 
Migrations' permission tool allows setting permissions to the role which
doesn't match the role type, e.g. m_ permissions for u_ role types and so on.
As one of side effects, this may lead to granting users moderative/admin
permissions silently.
With this patch the only new permissions matching the role type will be set.

PHPBB3-13779
This commit is contained in:
rxu 2015-04-26 10:51:01 +07:00
parent 887f83589f
commit 2308472eb0
1 changed files with 17 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
phpBB/phpbb/db/migration/tool/permission.php
View file

@ -425,13 +425,27 @@ class permission implements \phpbb\db\migration\tool\tool_interface
$role_id = (int) $this->db->sql_fetchfield('auth_role_id'); $role_id = (int) $this->db->sql_fetchfield('auth_role_id');
if ($role_id) if ($role_id)
{ {
$sql = 'SELECT role_name $sql = 'SELECT role_name, role_type
FROM ' . ACL_ROLES_TABLE . ' FROM ' . ACL_ROLES_TABLE . '
WHERE role_id = ' . $role_id; WHERE role_id = ' . $role_id;
$this->db->sql_query($sql); $this->db->sql_query($sql);
$role_name = $this->db->sql_fetchfield('role_name'); $role_data = $this->db->sql_fetchrow();
$role_name = $role_data['role_name'];
$role_type = $role_data['role_type'];
return $this->permission_set($role_name, $auth_option, 'role', $has_permission); // Filter new auth options to match the role type: a_ | f_ | m_ | u_
// Set new auth options to the role only if options matching the role type were found
$auth_option = array_filter($auth_option,
function ($option) use ($role_type)
{
return strpos($option, $role_type) === 0;
}
);
if (sizeof($auth_option))
{
return $this->permission_set($role_name, $auth_option, 'role', $has_permission);
}
} }
$sql = 'SELECT auth_option_id, auth_setting $sql = 'SELECT auth_option_id, auth_setting