From e690ba62b5365676f7b5dca49d34c7532cde9f4e Mon Sep 17 00:00:00 2001
From: lanzongjun <lanzongjun@easycorp.ltd>
Date: Mon, 5 Jun 2023 11:14:37 +0800
Subject: [PATCH] * Fix attackers create document in private product, project,
 execution and custom.

---
 module/common/model.php | 38 ++++++++++++++++++++++++++++++++++++++
 module/doc/control.php  |  1 +
 2 files changed, 39 insertions(+)

diff --git a/module/common/model.php b/module/common/model.php
index 694971f869..c1b589404e 100644
--- a/module/common/model.php
+++ b/module/common/model.php
@@ -3632,6 +3632,44 @@ EOF;
 
         return false;
     }
+
+    /**
+     * Check object priv.
+     *
+     * @param  string   $objectType
+     * @param  int      $objectID
+     * @access public
+     * @return bool
+     */
+    public function checkPrivByObject($objectType, $objectID)
+    {
+        $objectType = strtolower($objectType);
+        $canVisit   = true;
+        switch($objectType)
+        {
+            case 'custom':
+                $doclib = $this->loadModel('doc')->getLibById($objectID);
+                if(($doclib->acl == 'custom' or $doclib->acl == 'private') and strpos($doclib->users, (string)$this->app->user->account) === false) $canVisit = false;
+                break;
+            case 'product':
+                $doclib   = $this->loadModel('doc')->getLibById($objectID);
+                $canVisit = $this->loadModel('product')->checkPriv($doclib->product);
+                break;
+            case 'project':
+                $doclib   = $this->loadModel('doc')->getLibById($objectID);
+                $canVisit = $this->loadModel('project')->checkPriv($doclib->project);
+                break;
+            case 'execution':
+                $doclib   = $this->loadModel('doc')->getLibById($objectID);
+                $canVisit = $this->loadModel('execution')->checkPriv($doclib->execution);
+                break;
+            default:
+                break;
+        }
+
+        return $canVisit;
+    }
+
 }
 
 class common extends commonModel
diff --git a/module/doc/control.php b/module/doc/control.php
index aa0771a9c1..91e400d1fb 100755
--- a/module/doc/control.php
+++ b/module/doc/control.php
@@ -377,6 +377,7 @@ class doc extends control
 
         if(!empty($_POST))
         {
+            if($this->loadModel('common')->checkPrivByObject($objectType, $libID) === false) return $this->send(array('result' => 'fail', 'message' => $this->lang->doc->accessDenied));
             $libID    = $this->post->lib;
             $moduleID = $this->post->module;
             if(empty($libID) and strpos($this->post->module, '_') !== false) list($libID, $moduleID) = explode('_', $this->post->module);