From 53a68cac8ffd14ed4220f6591468af09fe482483 Mon Sep 17 00:00:00 2001
From: zhujinyong <zhujinyong@cnezsoft.com>
Date: Thu, 9 Sep 2021 06:32:28 +0800
Subject: [PATCH] + Add checkPriv for api.

---
 framework/api/entry.class.php | 20 ++++++++++++++++++++
 www/api.php                   |  3 +++
 2 files changed, 23 insertions(+)

diff --git a/framework/api/entry.class.php b/framework/api/entry.class.php
index 1905de0985..8f8496fed1 100644
--- a/framework/api/entry.class.php
+++ b/framework/api/entry.class.php
@@ -264,6 +264,10 @@ class baseEntry
             global $app;
             $app->setModuleName($moduleName);
             $app->setMethodName($methodName);
+
+            /* Check user permission. */
+            $this->checkPriv();
+
             $app->setControlFile();
 
             /*
@@ -550,4 +554,20 @@ class baseEntry
         $entry     = new $entryName();
         return call_user_func_array(array($entry, $method), $params);
     }
+
+    /**
+     * Check the user has permission to access this method, if not, return 403.
+     *
+     * @access public
+     * @return void
+     */
+    public function checkPriv()
+    {
+        $module = $this->app->getModuleName();
+        $method = $this->app->getMethodName();
+        if($module and $method and !commonModel::hasPriv($module, $method))
+        {
+            $this->send(403, array('error' => 'Access not allowed'));
+        }
+    }
 }
diff --git a/www/api.php b/www/api.php
index e494d251e8..ad435190e3 100644
--- a/www/api.php
+++ b/www/api.php
@@ -42,7 +42,10 @@ if(!$app->version) $config->requestType = 'GET';
 $config->default->view = 'json';
 
 $app->parseRequest();
+
+/* Old version need check priv here, new version check priv in entry. */
 if(!$app->version) $common->checkPriv();
+
 $app->loadModule();
 
 $output = ob_get_clean();