Peter M. Groen / knowledgetree

Commit eb689565067976d9b3fb499d9cf2e47f9c98b2c8

Authored by Megan Watson
1 parent 11f1acdc

KTS-3211 

"Search not adhering to read permissions"
Fixed. Added permissions to the sql.

Committed by: Megan Watson
Reviewed by: Kevin Fourie



git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@8321 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 1 changed file with 12 additions and 2 deletions
search2/search/expr.inc.php
  View file @eb68956
... ... @@ -1161,9 +1161,19 @@ class SQLQueryBuilder implements QueryBuilder
1161 1161 $sql .= " LEFT JOIN document_fields df$offset ON df$offset.id=dfl$offset.document_field_id" . "\n";
1162 1162 }
1163 1163  
  1164 + // Add permissions sql for read access
  1165 + $oPermission =& KTPermission::getByName('ktcore.permissions.read');
  1166 + $permId = $oPermission->getID();
  1167 + $oUser = User::get($_SESSION['userID']);
  1168 + $aPermissionDescriptors = KTPermissionUtil::getPermissionDescriptorsForUser($oUser);
  1169 + $sPermissionDescriptors = (!empty($aPermissionDescriptors)) ? implode(',', $aPermissionDescriptors) : '';
1164 1170  
1165   - $sql .=
1166   - 'WHERE dmv.status_id=1 AND d.status_id=1 AND ' . "\n ";
  1171 + $sql .= 'LEFT JOIN folders f ON d.folder_id = f.id '. "\n";
  1172 +
  1173 + $sql .= 'INNER JOIN permission_lookups AS PL ON f.permission_lookup_id = PL.id '. "\n";
  1174 + $sql .= 'INNER JOIN permission_lookup_assignments AS PLA ON PL.id = PLA.permission_lookup_id AND PLA.permission_id = '.$permId. " \n";
  1175 +
  1176 + $sql .= "WHERE PLA.permission_descriptor_id IN ($sPermissionDescriptors) AND dmv.status_id=1 AND d.status_id=1 AND \n ";
1167 1177  
1168 1178 return $sql;
1169 1179 }
... ...