From bea01a76e6826c24189d2be3775cca85354c1f3a Mon Sep 17 00:00:00 2001
From: Neil Blakey-Milner <nbm@knowledgetree.com>
Date: Fri, 18 Nov 2005 18:27:26 +0000
Subject: [PATCH] By default, document actions require the ktcore.permissions.read permission to display and to be called.

---
 lib/actions/documentaction.inc.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/actions/documentaction.inc.php b/lib/actions/documentaction.inc.php
index 680404f..e20b013 100644
--- a/lib/actions/documentaction.inc.php
+++ b/lib/actions/documentaction.inc.php
@@ -9,7 +9,7 @@ class KTDocumentAction extends KTStandardDispatcher {
     var $sDescription;
     var $sDisplayName;
 
-    var $_sShowPermission;
+    var $_sShowPermission = "ktcore.permissions.read";
     var $_sDisablePermission;
 
     var $_bDisabled;
@@ -99,6 +99,9 @@ class KTDocumentAction extends KTStandardDispatcher {
 
     function check() {
         $this->oDocument =& $this->oValidator->validateDocument($_REQUEST['fDocumentId']);
+        if ($this->_show() === false) {
+            return false;
+        }
         return true;
     }
 
--
libgit2 0.21.4