Skip to content
Snippets Groups Projects
Commit 90b95db7 authored by Rob Swindell's avatar Rob Swindell :speech_balloon:
Browse files

Add/use user_can_access_grp() to resolve issue #905

If a message group has no sub-boards (or no sub-boards that ther user can
access) then the user cannot access the group, so don't include the group in
JS msg_area.grp_list[].
parent 7b42b9be
No related branches found
No related tags found
No related merge requests found
...@@ -500,7 +500,7 @@ JSBool js_msg_area_resolve(JSContext* cx, JSObject* areaobj, jsid id) ...@@ -500,7 +500,7 @@ JSBool js_msg_area_resolve(JSContext* cx, JSObject* areaobj, jsid id)
val = OBJECT_TO_JSVAL(grpobj); val = OBJECT_TO_JSVAL(grpobj);
grp_index = -1; grp_index = -1;
if (p->user == NULL || chk_ar(p->cfg, p->cfg->grp[l]->ar, p->user, p->client)) { if (p->user == NULL || user_can_access_grp(p->cfg, l, p->user, p->client)) {
if (!JS_GetArrayLength(cx, grp_list, (jsuint*)&grp_index)) if (!JS_GetArrayLength(cx, grp_list, (jsuint*)&grp_index))
return JS_FALSE; return JS_FALSE;
......
...@@ -3591,6 +3591,22 @@ size_t user_field_len(enum user_field fnum) ...@@ -3591,6 +3591,22 @@ size_t user_field_len(enum user_field fnum)
} }
} }
/****************************************************************************/
// Determine if the specified user can access one or more sub-boards of group
/****************************************************************************/
bool user_can_access_grp(scfg_t* cfg, int grpnum, user_t* user, client_t* client)
{
uint count = 0;
for (int subnum = 0; subnum < cfg->total_subs; ++subnum) {
if (cfg->sub[subnum]->grp != grpnum)
continue;
if (user_can_access_sub(cfg, subnum, user, client)) // checks grp's AR already
count++;
}
return count >= 1; // User has access to one or more sub-boards of group
}
/****************************************************************************/ /****************************************************************************/
/* Determine if the specified user can or cannot access the specified sub */ /* Determine if the specified user can or cannot access the specified sub */
/****************************************************************************/ /****************************************************************************/
......
...@@ -156,6 +156,7 @@ DLLEXPORT bool user_can_access_all_libs(scfg_t*, user_t*, client_t*); ...@@ -156,6 +156,7 @@ DLLEXPORT bool user_can_access_all_libs(scfg_t*, user_t*, client_t*);
DLLEXPORT bool user_can_access_all_dirs(scfg_t*, int libnum, user_t*, client_t*); DLLEXPORT bool user_can_access_all_dirs(scfg_t*, int libnum, user_t*, client_t*);
DLLEXPORT bool user_can_access_lib(scfg_t*, int libnum, user_t*, client_t*); DLLEXPORT bool user_can_access_lib(scfg_t*, int libnum, user_t*, client_t*);
DLLEXPORT bool user_can_access_dir(scfg_t*, int dirnum, user_t*, client_t* client); DLLEXPORT bool user_can_access_dir(scfg_t*, int dirnum, user_t*, client_t* client);
DLLEXPORT bool user_can_access_grp(scfg_t*, int subnum, user_t*, client_t* client);
DLLEXPORT bool user_can_access_sub(scfg_t*, int subnum, user_t*, client_t* client); DLLEXPORT bool user_can_access_sub(scfg_t*, int subnum, user_t*, client_t* client);
DLLEXPORT bool user_can_read_sub(scfg_t*, int subnum, user_t*, client_t* client); DLLEXPORT bool user_can_read_sub(scfg_t*, int subnum, user_t*, client_t* client);
DLLEXPORT bool user_can_post(scfg_t*, int subnum, user_t*, client_t* client, uint* reason); DLLEXPORT bool user_can_post(scfg_t*, int subnum, user_t*, client_t* client, uint* reason);
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment