+ Add checkPriv for api.

2021-09-09 06:32:28 +08:00
parent c4be0c2c26
commit 53a68cac8f
2 changed files with 23 additions and 0 deletions
@@ -264,6 +264,10 @@ class baseEntry
            global $app;
            $app->setModuleName($moduleName);
            $app->setMethodName($methodName);
+
+            /* Check user permission. */
+            $this->checkPriv();
+
            $app->setControlFile();

            /*
@@ -550,4 +554,20 @@ class baseEntry
        $entry     = new $entryName();
        return call_user_func_array(array($entry, $method), $params);
    }
+
+    /**
+     * Check the user has permission to access this method, if not, return 403.
+     *
+     * @access public
+     * @return void
+     */
+    public function checkPriv()
+    {
+        $module = $this->app->getModuleName();
+        $method = $this->app->getMethodName();
+        if($module and $method and !commonModel::hasPriv($module, $method))
+        {
+            $this->send(403, array('error' => 'Access not allowed'));
+        }
+    }
 }