DVR: api - fix the dvr config entry create perm check

tvheadend · Sep 8, 2014 · 3c64f87 · 3c64f87
1 parent df7c00d
commit 3c64f87
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/src/api/api_dvr.c b/src/api/api_dvr.c
@@ -71,7 +71,8 @@ api_dvr_config_create
     return EINVAL;
   if (s[0] == '\0')
     return EINVAL;
-  if (access_verify2(perm, ACCESS_RECORDER_ALL | ACCESS_RECORDER))
+  if (access_verify2(perm, ACCESS_ADMIN) &&
+      access_verify2(perm, ACCESS_RECORDER_ALL | ACCESS_RECORDER))
     return EACCES;
 
   pthread_mutex_lock(&global_lock);

diff --git a/src/dvr/dvr_db.c b/src/dvr/dvr_db.c
@@ -1964,7 +1964,9 @@ dvr_config_class_perm(idnode_t *self, access_t *a, htsmsg_t *msg_to_write)
   dvr_config_t *cfg = (dvr_config_t *)self;
   if (access_verify2(a, ACCESS_RECORDER))
     return -1;
-  if (access_verify2(a, ACCESS_ADMIN) && access_verify2(a, ACCESS_RECORDER_ALL))
+  if (!access_verify2(a, ACCESS_ADMIN))
+    return 0;
+  if (access_verify2(a, ACCESS_RECORDER_ALL))
     return 0;
   if (strcmp(cfg->dvr_config_name ?: "", a->aa_username ?: ""))
     return -1;