* Fix attackers create document in private product, project, execution and custom.

2023-06-05 11:27:12 +08:00
parent 3ceabcf182
commit e690ba62b5
2 changed files with 39 additions and 0 deletions
@@ -377,6 +377,7 @@ class doc extends control

        if(!empty($_POST))
        {
+            if($this->loadModel('common')->checkPrivByObject($objectType, $libID) === false) return $this->send(array('result' => 'fail', 'message' => $this->lang->doc->accessDenied));
            $libID    = $this->post->lib;
            $moduleID = $this->post->module;
            if(empty($libID) and strpos($this->post->module, '_') !== false) list($libID, $moduleID) = explode('_', $this->post->module);