From 14dcc82e76f37aa733f4f35e16bfcb20fb7cbb68 Mon Sep 17 00:00:00 2001 From: Ingo Schommer Date: Mon, 18 Feb 2013 15:30:36 +0100 Subject: [PATCH] BUG Find Form actions in CompositeFields for access checks This bug was introduced with the new nested CMS actions around December 2012, but wasn't noticed until now because checkAccessAction() would wrongly return TRUE before the dataFieldByName() check was reached. --- forms/Form.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/forms/Form.php b/forms/Form.php index db1a695c3ef..bbe06d98163 100644 --- a/forms/Form.php +++ b/forms/Form.php @@ -289,7 +289,7 @@ public function httpSubmission($request) { $this->controller->hasMethod($funcName) && !$this->controller->checkAccessAction($funcName) // If a button exists, allow it on the controller - && !$this->actions->fieldByName('action_' . $funcName) + && !$this->actions->dataFieldByName('action_' . $funcName) ) { return $this->httpError( 403,