+ Add checkPriv for api.

framework/api/entry.class.php

@@ -264,6 +264,10 @@ class baseEntry
             global $app;
             $app->setModuleName($moduleName);
             $app->setMethodName($methodName);
+
+            /* Check user permission. */
+            $this->checkPriv();
+
             $app->setControlFile();
 
             /*
@@ -550,4 +554,20 @@ class baseEntry
         $entry     = new $entryName();
         return call_user_func_array(array($entry, $method), $params);
     }
+
+    /**
+     * Check the user has permission to access this method, if not, return 403.
+     *
+     * @access public
+     * @return void
+     */
+    public function checkPriv()
+    {
+        $module = $this->app->getModuleName();
+        $method = $this->app->getMethodName();
+        if($module and $method and !commonModel::hasPriv($module, $method))
+        {
+            $this->send(403, array('error' => 'Access not allowed'));
+        }
+    }
 }

www/api.php

@@ -42,7 +42,10 @@ if(!$app->version) $config->requestType = 'GET';
 $config->default->view = 'json';
 
 $app->parseRequest();
+
+/* Old version need check priv here, new version check priv in entry. */
 if(!$app->version) $common->checkPriv();
+
 $app->loadModule();
 
 $output = ob_get_clean();