dinislage/PrestaShop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[-] BO : restricted some unauthorized accesses #PSCFV-3611

Browse Source
This commit is contained in:
dMetzger
2012-08-14 08:34:16 +00:00
parent 74ec20eea0
commit b2ab9a3d95
3 changed files with 48 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
classes/Profile.php
+15 -10
View File
@@ -110,17 +110,25 @@ class ProfileCore extends ObjectModel
return (isset($accesses[$id_tab]) ? $accesses[$id_tab] : false);
}
public static function getProfileAccesses($id_profile)
public static function getProfileAccesses($id_profile, $type = 'id_tab')
{
if (!in_array($type, array('id_tab', 'class_name')))
return false;
if (!isset(self::$_cache_accesses[$id_profile]))
self::$_cache_accesses[$id_profile] = array();
if (!isset(self::$_cache_accesses[$id_profile][$type]))
{
self::$_cache_accesses[$id_profile][$type] = array();
// Super admin profile has full auth
if ($id_profile == _PS_ADMIN_PROFILE_)
{
foreach (Tab::getTabs(Context::getContext()->language->id) as $tab)
self::$_cache_accesses[$id_profile][$tab['id_tab']] = array(
self::$_cache_accesses[$id_profile][$type][$tab[$type]] = array(
'id_profile' => _PS_ADMIN_PROFILE_,
'id_tab' => $tab['id_tab'],
'class_name' => $tab['class_name'],
'view' => '1',
'add' => '1',
'edit' => '1',
@@ -131,19 +139,16 @@ class ProfileCore extends ObjectModel
{
$result = Db::getInstance()->executeS('
SELECT *
FROM `'._DB_PREFIX_.'access`
FROM `'._DB_PREFIX_.'access` a
LEFT JOIN `'._DB_PREFIX_.'tab` t ON t.id_tab = a.id_tab
WHERE `id_profile` = '.(int)$id_profile);
self::$_cache_accesses[$id_profile] = array();
foreach ($result as $row)
{
if (!isset(self::$_cache_accesses[$id_profile][$row['id_tab']]))
self::$_cache_accesses[$id_profile][$row['id_tab']] = array();
self::$_cache_accesses[$id_profile][$row['id_tab']] = $row;
}
self::$_cache_accesses[$id_profile][$type][$row[$type]] = $row;
}
}
return self::$_cache_accesses[$id_profile];
return self::$_cache_accesses[$id_profile][$type];
}
}