Security hardening

[jf-cbd]

Internal - security

[jf-cbd]

$oSecurityHelper->IsActionAllowed seems useless since AddScopeToQuery check if action is allowed

[Molkobain]

$oSecurityHelper->IsActionAllowed seems useless since AddScopeToQuery check if action is allowed

I think it is actually the other way around: SecurityHelper::IsActionAllowed() checks if there is a scope for the specified object and check if the object is within that scope.

Calling ScopeValidatorHelper::AddScopeToQuery() only tries to add the scope for specified object class, but it doesn't check if you have access to the object or not, whether it would be based on the scopes or the DM rights.

[jf-cbd]

Thanks for your message :) If there is no scope, then we should throw an error. Else it should be only filtered data rendered.

That should be enough, right ?

		if (!$oScopeValidator->AddScopeToQuery($oSearch, $sObjectClass)
		) {
			IssueLog::Warning(__METHOD__.' at line '.__LINE__.' : User #'.UserRights::GetUserId().' not allowed to read '.$sObjectClass.' object.');
			throw new HttpException(Response::HTTP_NOT_FOUND, Dict::S('UI:ObjectDoesNotExist'));
		}     

[Molkobain]

Exactly yes. You can check other usages of this method in the portal for an example, and see that we check the returned value. :)