BUG: refs #0460. We weren't doing a policy check when viewing a folder :(

zachmullen · zachmullen · commit 7fef18be1504 · 2012-01-25T11:40:41.000-05:00
diff --git a/core/controllers/FolderController.php b/core/controllers/FolderController.php
@@ -105,11 +105,15 @@ public function viewAction()
     $header = "";
     if(!isset($folder_id))
       {
-      throw new Zend_Exception("Please set the folderId.");
+      throw new Zend_Exception('Please set the folderId.');
       }
     elseif($folder === false)
       {
-      throw new Zend_Exception("The folder doesn t exist.");
+      throw new Zend_Exception('The folder doesn t exist.');
+      }
+    elseif(!$this->Folder->policyCheck($folder, $this->userSession->Dao, MIDAS_POLICY_READ))
+      {
+      throw new Zend_Exception('Invalid policy: no read access');
       }
     else
       {

Original file line number	Diff line number	Diff line change
`@@ -105,11 +105,15 @@ public function viewAction()`
`105`	`105`	`$header = "";`
`106`	`106`	`if(!isset($folder_id))`
`107`	`107`	`{`
`108`		`- throw new Zend_Exception("Please set the folderId.");`
	`108`	`+ throw new Zend_Exception('Please set the folderId.');`
`109`	`109`	`}`
`110`	`110`	`elseif($folder === false)`
`111`	`111`	`{`
`112`		`- throw new Zend_Exception("The folder doesn t exist.");`
	`112`	`+ throw new Zend_Exception('The folder doesn t exist.');`
	`113`	`+ }`
	`114`	`+ elseif(!$this->Folder->policyCheck($folder, $this->userSession->Dao, MIDAS_POLICY_READ))`
	`115`	`+ {`
	`116`	`+ throw new Zend_Exception('Invalid policy: no read access');`
`113`	`117`	`}`
`114`	`118`	`else`
`115`	`119`	`{`