Merge pull request #143 from LarsGit223/forbidden

Check acl, continues export with book_skipforbiddenpages=1 is set
lpaulsen93 · Aug 13, 2016 · eb2badb · eb2badb
2 parents 0b44384 + 68cad3c
commit eb2badb
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 4 deletions.
diff --git a/action/export.php b/action/export.php
@@ -254,6 +254,30 @@ protected function collectExportPages(Doku_Event $event) {
         }
 
         $list = array_map('cleanID', $list);
+
+        $skippedpages = array();
+        foreach($list as $index => $pageid) {
+            if(auth_quickaclcheck($pageid) < AUTH_READ) {
+                $skippedpages[] = $pageid;
+                unset($list[$index]);
+            }
+        }
+        $list = array_filter($list); //removes also pages mentioned '0'
+
+        //if selection contains forbidden pages throw (overridable) warning
+        if(!$INPUT->bool('book_skipforbiddenpages') && !empty($skippedpages)) {
+            $msg = sprintf($this->getLang('forbidden'), hsc(join(', ', $skippedpages)));
+            if($INPUT->has('selection')) {
+                http_status(400);
+                print $msg;
+                exit();
+            } else {
+                $this->showPageWithErrorMsg($event, null, $msg);
+                return false;
+            }
+
+        }
+
         return array($title, $list);
     }
 
@@ -355,10 +379,7 @@ protected function generateODT($cachefile, $title) {
 
         // loop over all pages
         $xmlcontent = '';
-
-        $cnt = count($this->list);
-        for($n = 0; $n < $cnt; $n++) {
-            $page = $this->list[$n];
+        foreach($this->list as $page) {
             $filename = wikiFN($page, $REV);
 
             if(!file_exists($filename)) {

diff --git a/lang/en/lang.php b/lang/en/lang.php
@@ -22,6 +22,7 @@
 $lang['needtitle']         = "Please provide a title.";
 $lang['needns']            = "Please provide an existing namespace.";
 $lang['empty']             = "You don't have pages selected yet.";
+$lang['forbidden']         = "You have no access to these pages: %s.<br/><br/>Use option 'Skip Forbidden Pages' to create your book with the available pages.";
 
 // Error message for failed conversion.
 // The following replacments are supported: