From 48fc034fa1f91b7ecb6a69c6ab8ccdec5cdf0651 Mon Sep 17 00:00:00 2001
From: pengjiangxiu <riverdream@yeah.net>
Date: Mon, 17 Jul 2017 15:33:40 +0800
Subject: [PATCH] * Finish task #3065.

---
 config/filter.php      |  2 +-
 module/doc/control.php | 29 +++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/config/filter.php b/config/filter.php
index 868577e010..34eb11263f 100644
--- a/config/filter.php
+++ b/config/filter.php
@@ -11,7 +11,7 @@ $filter->rules->orderBy    = '/^\w+_(desc|asc)$/i';
 $filter->rules->browseType = '/^by\w+$/i';
 $filter->rules->word       = '/^\w+$/';
 $filter->rules->paramName  = '/^[a-zA-Z0-9_\.]+$/';
-$filter->rules->paramValue = '/^[a-zA-Z0-9=_,`#+\^\/\.%\|\x7f-\xff]+$/';
+$filter->rules->paramValue = '/^[a-zA-Z0-9=_,`#+\s\^\/\.%\|\x7f-\xff]+$/';
 
 $filter->default = new stdclass(); 
 $filter->default->moduleName = 'code';
diff --git a/module/doc/control.php b/module/doc/control.php
index c6d44995fd..b229c4dc34 100644
--- a/module/doc/control.php
+++ b/module/doc/control.php
@@ -699,6 +699,19 @@ class doc extends control
             if($this->productID and $type == 'project') $crumb = $this->doc->getProductCrumb($this->productID, $objectID);
             $crumb .= html::a(inlink('objectLibs', "type=$type&objectID=$objectID"), $object->name);
             $crumb .= $this->lang->doc->separator . ' ' . $this->lang->doclib->files;
+
+            if($type == 'product')
+            {
+                $lib = $this->product->getById($objectID);
+                if(!$this->product->checkPriv($lib)) $this->accessDenied();
+            }
+
+            if($type == 'project')
+            {
+                $lib = $this->project->getById($objectID);
+                if(!$this->project->checkPriv($lib)) $this->accessDenied();
+            }
+            
             $this->doc->setMenu($libID = 0, $moduleID = 0, $crumb);
         }
 
@@ -716,6 +729,22 @@ class doc extends control
         $this->display();
     }
 
+    /**
+     * Show libs for product or project
+     * 
+     * @access private
+     * @return void
+     */
+    private function accessDenied()
+    {
+        echo(js::alert($this->lang->doc->accessDenied));
+
+        $loginLink = $this->config->requestType == 'GET' ? "?{$this->config->moduleVar}=user&{$this->config->methodVar}=login" : "user{$this->config->requestFix}login";
+
+       if(strpos($this->server->http_referer, $loginLink) !== false) die(js::locate(inlink('index')));
+       die(js::locate('back'));
+    }
+
     /**
      * Show libs for product or project
      *