* Fix attackers create document in private product, project, execution and custom.

module/common/model.php

@@ -3632,6 +3632,44 @@ EOF;
 
         return false;
     }
+
+    /**
+     * Check object priv.
+     *
+     * @param  string   $objectType
+     * @param  int      $objectID
+     * @access public
+     * @return bool
+     */
+    public function checkPrivByObject($objectType, $objectID)
+    {
+        $objectType = strtolower($objectType);
+        $canVisit   = true;
+        switch($objectType)
+        {
+            case 'custom':
+                $doclib = $this->loadModel('doc')->getLibById($objectID);
+                if(($doclib->acl == 'custom' or $doclib->acl == 'private') and strpos($doclib->users, (string)$this->app->user->account) === false) $canVisit = false;
+                break;
+            case 'product':
+                $doclib   = $this->loadModel('doc')->getLibById($objectID);
+                $canVisit = $this->loadModel('product')->checkPriv($doclib->product);
+                break;
+            case 'project':
+                $doclib   = $this->loadModel('doc')->getLibById($objectID);
+                $canVisit = $this->loadModel('project')->checkPriv($doclib->project);
+                break;
+            case 'execution':
+                $doclib   = $this->loadModel('doc')->getLibById($objectID);
+                $canVisit = $this->loadModel('execution')->checkPriv($doclib->execution);
+                break;
+            default:
+                break;
+        }
+
+        return $canVisit;
+    }
+
 }
 
 class common extends commonModel

module/doc/control.php

@@ -377,6 +377,7 @@ class doc extends control
 
         if(!empty($_POST))
         {
+            if($this->loadModel('common')->checkPrivByObject($objectType, $libID) === false) return $this->send(array('result' => 'fail', 'message' => $this->lang->doc->accessDenied));
             $libID    = $this->post->lib;
             $moduleID = $this->post->module;
             if(empty($libID) and strpos($this->post->module, '_') !== false) list($libID, $moduleID) = explode('_', $this->post->module);