From e81118c972fe03df4cbcf085a8c1b137545fd7e3 Mon Sep 17 00:00:00 2001 From: Ron Lucke <lucke@elan-ev.de> Date: Fri, 1 Apr 2022 14:03:32 +0000 Subject: [PATCH] fix #857 --- lib/classes/JsonApi/Routes/Courseware/BlocksCopy.php | 5 +++-- lib/classes/JsonApi/Routes/Courseware/ContainersCopy.php | 5 +++-- .../JsonApi/Routes/Courseware/StructuralElementsCopy.php | 3 ++- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/lib/classes/JsonApi/Routes/Courseware/BlocksCopy.php b/lib/classes/JsonApi/Routes/Courseware/BlocksCopy.php index 26c49ce5cf8..6d71a91b583 100755 --- a/lib/classes/JsonApi/Routes/Courseware/BlocksCopy.php +++ b/lib/classes/JsonApi/Routes/Courseware/BlocksCopy.php @@ -30,8 +30,9 @@ class BlocksCopy extends NonJsonApiController $block = \Courseware\Block::find($data['block']['id']); $container = \Courseware\Container::find($data['parent_id']); + $user = $this->getUser($request); - if (!Authority::canCreateBlocks($user = $this->getUser($request), $container)) { + if (!Authority::canCreateBlocks($user, $container) || !Authority::canUpdateBlock($user, $block)) { throw new AuthorizationFailedException(); } @@ -57,4 +58,4 @@ class BlocksCopy extends NonJsonApiController //TODO update section block ids return true; } -} \ No newline at end of file +} diff --git a/lib/classes/JsonApi/Routes/Courseware/ContainersCopy.php b/lib/classes/JsonApi/Routes/Courseware/ContainersCopy.php index 9f04e5350ac..2b99f65bf42 100755 --- a/lib/classes/JsonApi/Routes/Courseware/ContainersCopy.php +++ b/lib/classes/JsonApi/Routes/Courseware/ContainersCopy.php @@ -30,7 +30,8 @@ class ContainersCopy extends NonJsonApiController $container = \Courseware\Container::find($data['container']['id']); $element = \Courseware\StructuralElement::find($data['parent_id']); - if (!Authority::canCreateContainer($user = $this->getUser($request), $element)) { + $user = $this->getUser($request); + if (!Authority::canCreateContainer($user, $element) || !Authority::canUpdateContainer($user, $container)) { throw new AuthorizationFailedException(); } @@ -48,4 +49,4 @@ class ContainersCopy extends NonJsonApiController return $container; } -} \ No newline at end of file +} diff --git a/lib/classes/JsonApi/Routes/Courseware/StructuralElementsCopy.php b/lib/classes/JsonApi/Routes/Courseware/StructuralElementsCopy.php index e56f266a535..68b0b4d6486 100755 --- a/lib/classes/JsonApi/Routes/Courseware/StructuralElementsCopy.php +++ b/lib/classes/JsonApi/Routes/Courseware/StructuralElementsCopy.php @@ -29,7 +29,8 @@ class StructuralElementsCopy extends NonJsonApiController $sourceElement = StructuralElement::find($args['id']); $newParent = StructuralElement::find($data['parent_id']); - if (!Authority::canCreateContainer($user = $this->getUser($request), $newParent)) { + $user = $this->getUser($request); + if (!Authority::canCreateStructuralElement($user, $newParent) || !Authority::canUpdateStructuralElement($user, $sourceElement)) { throw new AuthorizationFailedException(); } -- GitLab