Catch permissions, don't rely on fatal error.

horde · May 27, 2014 · a090885 · a090885
1 parent a9e6620
commit a090885
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/kronolith/lib/Application.php b/kronolith/lib/Application.php
@@ -575,6 +575,11 @@ public function download(Horde_Variables $vars)
             foreach ($calendars as $calendar) {
                 list($type, $cal) = explode('_', $calendar, 2);
                 $kronolith_driver = Kronolith::getDriver($type, $cal);
+                $calendarObject = Kronolith::getCalendar($kronolith_driver);
+                if (!$calendarObject ||
+                    !$calendarObject->hasPermission(Horde_Perms::READ)) {
+                    throw new Horde_Exception_PermissionDenied();
+                }
                 $events[$calendar] = $kronolith_driver->listEvents(
                     $start,
                     $end,
@@ -622,7 +627,9 @@ public function download(Horde_Variables $vars)
                     }
                 }
 
-                $injector->getInstance('Horde_Core_Factory_Data')->create('Csv', array('cleanup' => array($this, 'cleanupData')))->exportFile(_("events.csv"), $data, true);
+                $injector->getInstance('Horde_Core_Factory_Data')
+                    ->create('Csv', array('cleanup' => array($this, 'cleanupData')))
+                    ->exportFile(_("events.csv"), $data, true);
                 exit;
 
             case Horde_Data::EXPORT_ICALENDAR: