From 1dd575d6ca818ff3550fba11e31ad8dcf020f1ea Mon Sep 17 00:00:00 2001
From: songchenxuan <songchenxuan@easycorp.ltd>
Date: Wed, 14 Jun 2023 13:37:31 +0800
Subject: [PATCH] * Try to fix bug #35859.

---
 module/doc/control.php | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/module/doc/control.php b/module/doc/control.php
index 206d328315..6d7176bcdd 100755
--- a/module/doc/control.php
+++ b/module/doc/control.php
@@ -377,16 +377,26 @@ class doc extends control
 
         if(!empty($_POST))
         {
-            $doclib   = $this->loadModel('doc')->getLibById($objectID);
+            $doclib   = $this->loadModel('doc')->getLibById($libID);
             $canVisit = true;
-            if('custom' == $objectType)
+
+            switch($objectType)
             {
-                $account = $this->app->user->account;
-                if(($doclib->acl == 'custom' or $doclib->acl == 'private') and strpos($doclib->users, $account) === false and $doclib->addedBy !== $account) $canVisit = false;
-            }
-            else
-            {
-                $canVisit = $this->loadModel('common')->checkPrivByObject($objectType, $doclib->$objectType);
+                case 'custom':
+                    $account = (string)$this->app->user->account;
+                    if(($doclib->acl == 'custom' or $doclib->acl == 'private') and strpos($doclib->users, $account) === false and $doclib->addedBy !== $account) $canVisit = false;
+                    break;
+                case 'product':
+                    $canVisit = $this->loadModel('product')->checkPriv($doclib->product);
+                    break;
+                case 'project':
+                    $canVisit = $this->loadModel('project')->checkPriv($doclib->project);
+                    break;
+                case 'execution':
+                    $canVisit = $this->loadModel('execution')->checkPriv($doclib->execution);
+                    break;
+                default:
+                break;
             }
             if(!$canVisit) return $this->send(array('result' => 'fail', 'message' => $this->lang->doc->accessDenied));