From fc3b73116a1ed5260a791146a212f73e2a175b6b Mon Sep 17 00:00:00 2001
From: zenggang <zenggang@easycorp.ltd>
Date: Fri, 1 Sep 2023 03:27:49 +0000
Subject: [PATCH] * Fix bug#38087

---
 config/zentaopms.php        | 3 +++
 module/instance/control.php | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/config/zentaopms.php b/config/zentaopms.php
index 91a4093f58..35749cc4ab 100644
--- a/config/zentaopms.php
+++ b/config/zentaopms.php
@@ -287,6 +287,9 @@ $config->openMethods[] = 'gitea.edit';
 $config->openMethods[] = 'gitea.binduser';
 $config->openMethods[] = 'jenkins.create';
 $config->openMethods[] = 'jenkins.edit';
+$config->openMethods[] = 'instance.createexternalapp';
+$config->openMethods[] = 'instance.editexternalapp';
+$config->openMethods[] = 'instance.deleteexternalapp';
 
 $config->openModules = array();
 $config->openModules[] = 'install';
diff --git a/module/instance/control.php b/module/instance/control.php
index 81df031473..5920958d81 100644
--- a/module/instance/control.php
+++ b/module/instance/control.php
@@ -410,6 +410,8 @@ class instance extends control
      */
     public function createExternalApp(string $type)
     {
+        if(!commonModel::hasPriv('space', 'browse')) $this->loadModel('common')->deny('space', 'browse', false);
+
         $this->app->loadModuleConfig('sonarqube');
         $this->app->loadLang('pipeline');
 
@@ -442,6 +444,8 @@ class instance extends control
      */
     public function editExternalApp(int $externalID)
     {
+        if(!commonModel::hasPriv('space', 'browse')) $this->loadModel('common')->deny('space', 'browse', false);
+
         $oldApp = $this->loadModel('pipeline')->getByID($externalID);
 
         if($_POST)
@@ -474,6 +478,8 @@ class instance extends control
      */
     public function deleteExternalApp(int $externalID)
     {
+        if(!commonModel::hasPriv('space', 'browse')) $this->loadModel('common')->deny('space', 'browse', false);
+
         $oldApp = $this->loadModel('pipeline')->getByID($externalID);
         $actionID = $this->pipeline->delete($externalID, $oldApp->type);
         if(!$actionID)