Merge pull request #2281 from connortechnology/fix_2279_delete_camera…

…_through_api Fix 2279 delete camera through api
ZoneMinder · Oct 30, 2018 · 073193e · 073193e
2 parents 3906103 + 9a2d58a
commit 073193e
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 4 deletions.
diff --git a/web/api/app/Controller/MonitorsController.php b/web/api/app/Controller/MonitorsController.php
@@ -207,8 +207,10 @@ public function delete($id = null) {
     if ( !$this->Monitor->exists() ) {
       throw new NotFoundException(__('Invalid monitor'));
     }
-    if ( $this->Session->Read('systemPermission') != 'Edit' ) {
-       throw new UnauthorizedException(__('Insufficient privileges'));
+    global $user;
+    $canEdit = (!$user) || ($user['System'] == 'Edit');
+    if ( !$canEdit ) {
+      throw new UnauthorizedException(__('Insufficient privileges'));
       return;
     }
     $this->request->allowMethod('post', 'delete');

diff --git a/web/api/app/Controller/StatesController.php b/web/api/app/Controller/StatesController.php
@@ -59,8 +59,9 @@ public function add() {
 
   if ($this->request->is('post')) {
 
-    if ($this->Session->Read('systemPermission') != 'Edit')
-    {
+    global $user;
+    $canEdit = (!$user) || ($user['System'] == 'Edit');
+    if ( !$canEdit ) {
       throw new UnauthorizedException(__('Insufficient privileges'));
       return;
     }