Skip to content

Commit

Permalink
Merge branch 'security/4.2/acl-addrecord' into security/4.2.10-releng
Browse files Browse the repository at this point in the history
  • Loading branch information
@alexmv
alexmv committed Feb 25, 2015
2 parents 4062beb + 7b923f3 commit b737738
Show file tree
Hide file tree
Showing 12 changed files with 81 additions and 177 deletions.
33 changes: 10 additions & 23 deletions lib/RT/ACL.pm
View file
Original file line number Diff line number Diff line change
Expand Up @@ -188,34 +188,21 @@ sub LimitToPrincipal {



sub Next {
sub AddRecord {
my $self = shift;
my ($record) = @_;

my $ACE = $self->SUPER::Next();
# Short-circuit having to load up the ->Object
return $ACE
if $self->CurrentUser->PrincipalObj->Id == RT->SystemUser->Id;
if ( ( defined($ACE) ) and ( ref($ACE) ) ) {

if ( $self->CurrentUser->HasRight( Right => 'ShowACL',
Object => $ACE->Object )
or $self->CurrentUser->HasRight( Right => 'ModifyACL',
Object => $ACE->Object )
) {
return ($ACE);
}
return $self->SUPER::AddRecord( $record )
if $record->CurrentUser->PrincipalObj->Id == RT->SystemUser->Id;

#If the user doesn't have the right to show this ACE
else {
return ( $self->Next() );
}
}

#if there never was any ACE
else {
return (undef);
}
my $obj = $record->Object;
return unless $self->CurrentUser->HasRight( Right => 'ShowACL',
Object => $obj )
or $self->CurrentUser->HasRight( Right => 'ModifyACL',
Object => $obj );

return $self->SUPER::AddRecord( $record );
}

# The singular of ACL is ACE.
Expand Down
28 changes: 7 additions & 21 deletions lib/RT/Articles.pm
View file
Original file line number Diff line number Diff line change
Expand Up @@ -64,33 +64,19 @@ sub _Init {
return $self->SUPER::_Init( @_ );
}

=head2 Next
=head2 AddRecord
Returns the next article that this user can see.
Overrides the collection to ensure that only Articles the user can see
are returned.
=cut

sub Next {
sub AddRecord {
my $self = shift;
my ($record) = @_;

my $Object = $self->SUPER::Next();
if ( ( defined($Object) ) and ( ref($Object) ) ) {

if ( $Object->CurrentUserHasRight('ShowArticle') ) {
return ($Object);
}

#If the user doesn't have the right to show this Object
else {
return ( $self->Next() );
}
}

#if there never was any queue
else {
return (undef);
}

return unless $record->CurrentUserHasRight('ShowArticle');
return $self->SUPER::AddRecord( $record );
}

=head2 Limit { FIELD => undef, OPERATOR => '=', VALUE => 'undef'}
Expand Down
15 changes: 4 additions & 11 deletions lib/RT/Attachments.pm
View file
Original file line number Diff line number Diff line change
Expand Up @@ -215,19 +215,12 @@ sub LimitByTicket {
return;
}

# {{{ sub Next
sub Next {
sub AddRecord {
my $self = shift;
my ($record) = @_;

my $Attachment = $self->SUPER::Next;
return $Attachment unless $Attachment;

if ( $Attachment->TransactionObj->CurrentUserCanSee ) {
return $Attachment;
} else {
# If the user doesn't have the right to show this ticket
return $self->Next;
}
return unless $record->TransactionObj->CurrentUserCanSee;
return $self->SUPER::AddRecord( $record );
}

RT::Base->_ImportOverlays();
Expand Down
27 changes: 7 additions & 20 deletions lib/RT/Classes.pm
View file
Original file line number Diff line number Diff line change
Expand Up @@ -64,32 +64,19 @@ sub Table {'Classes'}
return ($self->SUPER::_Init(@_));
}

=head2 Next
=head2 AddRecord
Returns the next Object that this user can see.
Overrides the collection to ensure that only Classes the user can
see are returned.
=cut

sub Next {
sub AddRecord {
my $self = shift;
my ($record) = @_;


my $Object = $self->SUPER::Next();
if ((defined($Object)) and (ref($Object))) {
if ( $Object->CurrentUserHasRight('SeeClass') ) {
return($Object);
}

#If the user doesn't have the right to show this Object
else {
return($self->Next());
}
}
#if there never was any Object
else {
return(undef);
}

return unless $record->CurrentUserHasRight('SeeClass');
return $self->SUPER::AddRecord( $record );
}

sub _SingularClass { "RT::Class" }
Expand Down
18 changes: 8 additions & 10 deletions lib/RT/CustomFields.pm
View file
Original file line number Diff line number Diff line change
Expand Up @@ -378,22 +378,20 @@ sub _OCFAlias {
}


=head2 Next
=head2 AddRecord
Returns the next custom field that this user can see.
Overrides the collection to ensure that only custom fields the user can
see are returned; also propagates down the L</ContextObject>.
=cut

sub Next {
sub AddRecord {
my $self = shift;
my ($record) = @_;

my $CF = $self->SUPER::Next();
return $CF unless $CF;

$CF->SetContextObject( $self->ContextObject );

return $self->Next unless $CF->CurrentUserHasRight('SeeCustomField');
return $CF;
$record->SetContextObject( $self->ContextObject );
return unless $record->CurrentUserHasRight('SeeCustomField');
return $self->SUPER::AddRecord( $record );
}

=head2 NewItem
Expand Down
8 changes: 2 additions & 6 deletions lib/RT/Dashboard.pm
View file
Original file line number Diff line number Diff line change
Expand Up @@ -255,8 +255,7 @@ sub _PrivacyObjects {

my $groups = RT::Groups->new($CurrentUser);
$groups->LimitToUserDefinedGroups;
$groups->WithMember( PrincipalId => $CurrentUser->Id,
Recursively => 1 );
$groups->WithCurrentUser;
push @objects, @{ $groups->ItemsArrayRef };

push @objects, RT::System->new($CurrentUser);
Expand Down Expand Up @@ -386,10 +385,7 @@ sub ObjectsForLoading {
Right => 'SeeGroupDashboard',
IncludeSuperusers => $args{IncludeSuperuserGroups},
);
$groups->WithMember(
Recursively => 1,
PrincipalId => $CurrentUser->UserObj->PrincipalId
);
$groups->WithCurrentUser;
my $attrs = $groups->Join(
ALIAS1 => 'main',
FIELD1 => 'id',
Expand Down
29 changes: 16 additions & 13 deletions lib/RT/Groups.pm
View file
Original file line number Diff line number Diff line change
Expand Up @@ -272,6 +272,15 @@ sub WithMember {
return $members;
}

sub WithCurrentUser {
my $self = shift;
$self->{with_current_user} = 1;
return $self->WithMember(
PrincipalId => $self->CurrentUser->PrincipalId,
Recursively => 1,
);
}

sub WithoutMember {
my $self = shift;
my %args = (
Expand Down Expand Up @@ -459,22 +468,16 @@ sub LimitToDeleted {



sub Next {
sub AddRecord {
my $self = shift;
my ($record) = @_;

# Don't show groups which the user isn't allowed to see.
# If we've explicitly limited to groups the user is a member of (for
# dashboard or savedsearch privacy objects), skip the ACL.
return unless $self->{with_current_user}
or $record->CurrentUserHasRight('SeeGroup');

my $Group = $self->SUPER::Next();
if ((defined($Group)) and (ref($Group))) {
unless ($Group->CurrentUserHasRight('SeeGroup')) {
return $self->Next();
}

return $Group;
}
else {
return undef;
}
return $self->SUPER::AddRecord( $record );
}


Expand Down
3 changes: 1 addition & 2 deletions lib/RT/SavedSearch.pm
View file
Original file line number Diff line number Diff line change
Expand Up @@ -162,8 +162,7 @@ sub _PrivacyObjects {

my $groups = RT::Groups->new($CurrentUser);
$groups->LimitToUserDefinedGroups;
$groups->WithMember( PrincipalId => $CurrentUser->Id,
Recursively => 1 );
$groups->WithCurrentUser;
if ($has_attr) {
my $attrs = $groups->Join(
ALIAS1 => 'main',
Expand Down
30 changes: 7 additions & 23 deletions lib/RT/Scrips.pm
View file
Original file line number Diff line number Diff line change
Expand Up @@ -238,35 +238,19 @@ sub ApplySortOrder {
} );
}

# {{{ sub Next
=head2 AddRecord
=head2 Next
Returns the next scrip that this user can see.
Overrides the collection to ensure that only scrips the user can see are
returned.
=cut

sub Next {
sub AddRecord {
my $self = shift;
my ($record) = @_;


my $Scrip = $self->SUPER::Next();
if ((defined($Scrip)) and (ref($Scrip))) {

if ($Scrip->CurrentUserHasRight('ShowScrips')) {
return($Scrip);
}

#If the user doesn't have the right to show this scrip
else {
return($self->Next());
}
}
#if there never was any scrip
else {
return(undef);
}

return unless $record->CurrentUserHasRight('ShowScrips');
return $self->SUPER::AddRecord( $record );
}

=head2 Apply
Expand Down
12 changes: 8 additions & 4 deletions lib/RT/Template.pm
View file
Original file line number Diff line number Diff line change
Expand Up @@ -842,10 +842,14 @@ sub CompileCheck {
sub CurrentUserCanRead {
my $self =shift;

return 1 if $self->CurrentUserHasQueueRight('ShowTemplate');

return $self->CurrentUser->HasRight( Right =>'ShowGlobalTemplates', Object => $RT::System )
if !$self->QueueObj->Id;
if ($self->__Value('Queue')) {
my $queue = RT::Queue->new( RT->SystemUser );
$queue->Load( $self->__Value('Queue'));
return 1 if $self->CurrentUser->HasRight( Right => 'ShowTemplate', Object => $queue );
} else {
return 1 if $self->CurrentUser->HasRight( Right => 'ShowGlobalTemplates', Object => $RT::System );
return 1 if $self->CurrentUser->HasRight( Right => 'ShowTemplate', Object => $RT::System );
}

return;
}
Expand Down
32 changes: 7 additions & 25 deletions lib/RT/Templates.pm
View file
Original file line number Diff line number Diff line change
Expand Up @@ -125,37 +125,19 @@ sub LimitToQueue {
}


=head2 Next
=head2 AddRecord
Returns the next template that this user can see.
Overrides the collection to ensure that only templates the user can see
are returned.
=cut

sub Next {
sub AddRecord {
my $self = shift;
my ($record) = @_;


my $templ = $self->SUPER::Next();
if ((defined($templ)) and (ref($templ))) {

# If it's part of a queue, and the user can read templates in
# that queue, or the user can globally read templates, show it
if ($templ->Queue && $templ->CurrentUserHasQueueRight('ShowTemplate') or
$templ->CurrentUser->HasRight(Object => $RT::System, Right => 'ShowTemplate') or
$templ->CurrentUser->HasRight(Object => $RT::System, Right => 'ShowGlobalTemplates')) {
return($templ);
}

#If the user doesn't have the right to show this template
else {
return($self->Next());
}
}
#if there never was any template
else {
return(undef);
}

return unless $record->CurrentUserCanRead;
return $self->SUPER::AddRecord( $record );
}

RT::Base->_ImportOverlays();
Expand Down
23 changes: 4 additions & 19 deletions lib/RT/Transactions.pm
View file
Original file line number Diff line number Diff line change
Expand Up @@ -130,27 +130,12 @@ sub LimitToTicket {
}


sub Next {
sub AddRecord {
my $self = shift;
my ($record) = @_;

my $Transaction = $self->SUPER::Next();
if ((defined($Transaction)) and (ref($Transaction))) {
# If the user can see the transaction's type, then they can
# see the transaction and we should hand it back.
if ($Transaction->Type) {
return($Transaction);
}

#If the user doesn't have the right to show this ticket
else {
return($self->Next());
}
}

#if there never was any ticket
else {
return(undef);
}
return unless $record->CurrentUserCanSee;
return $self->SUPER::AddRecord($record);
}

RT::Base->_ImportOverlays();
Expand Down

0 comments on commit b737738

Please sign in to comment.