mirror/Part-DB.Part-DB-server
1
0
Fork 1
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2025-06-22 18:03:37 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Check permissions to view parts on the parts list pagees

Browse source
This commit is contained in:
Jan Böhmer 2022-10-09 22:01:44 +02:00
parent 0b83d0a0b0
commit afaa918ce6
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/Controller/PartListsController.php
View file

@ -80,6 +80,8 @@ class PartListsController extends AbstractController
*/ */
public function tableAction(Request $request, PartsTableActionHandler $actionHandler): Response public function tableAction(Request $request, PartsTableActionHandler $actionHandler): Response
{ {
$this->denyAccessUnlessGranted('@parts.edit');
$redirect = $request->request->get('redirect_back'); $redirect = $request->request->get('redirect_back');
$ids = $request->request->get('ids'); $ids = $request->request->get('ids');
$action = $request->request->get('action'); $action = $request->request->get('action');
@ -137,6 +139,8 @@ class PartListsController extends AbstractController
*/ */
protected function showListWithFilter(Request $request, string $template, ?callable $filter_changer = null, ?callable $form_changer = null, array $additonal_template_vars = [], array $additional_table_vars = []): Response protected function showListWithFilter(Request $request, string $template, ?callable $filter_changer = null, ?callable $form_changer = null, array $additonal_template_vars = [], array $additional_table_vars = []): Response
{ {
$this->denyAccessUnlessGranted('@parts.read');
$formRequest = clone $request; $formRequest = clone $request;
$formRequest->setMethod('GET'); $formRequest->setMethod('GET');
$filter = new PartFilter($this->nodesListBuilder); $filter = new PartFilter($this->nodesListBuilder);