amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-07-09 18:35:10 +00:00
Code Issues Projects Releases Wiki Activity

oc: Check FolderVisible permission to show permission list

Browse Source 
When the active user is not the owner of the resource as specified
by [MS-OXCPERM] Section 3.2.5.1
This commit is contained in:
Enrique J. Hernández Blasco
2016-01-27 23:02:10 +01:00
parent 026c37709a
commit 8c8ad301b4
1 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
OpenChange/MAPIStoreFolder.m
+15 -3
View File
@@ -1021,9 +1021,10 @@ Class NSExceptionK, MAPIStoreFAIMessageK, MAPIStoreMessageTableK, MAPIStoreFAIMe
tableType: (enum mapistore_table_type) tableType
andHandleId: (uint32_t) handleId
{
BOOL access;
enum mapistore_error rc = MAPISTORE_SUCCESS;
MAPIStoreTable *table;
SOGoUser *ownerUser;
SOGoUser *activeUser, *ownerUser;
if (tableType == MAPISTORE_MESSAGE_TABLE)
table = [self messageTable];
@@ -1034,8 +1035,19 @@ Class NSExceptionK, MAPIStoreFAIMessageK, MAPIStoreMessageTableK, MAPIStoreFAIMe
else if (tableType == MAPISTORE_PERMISSIONS_TABLE)
{
ownerUser = [[self userContext] sogoUser];
if ([[context activeUser] isEqual: ownerUser])
table = [self permissionsTable];
activeUser = [context activeUser];
access = [activeUser isEqual: ownerUser];
if (!access)
{
NSArray *roles;
roles = [[self aclFolder] aclsForUser: [activeUser login]];
/* Check FolderVisible right to return the table */
access = ([self exchangeRightsForRoles: roles] & RoleNone) != 0;
}
if (access)
table = [self permissionsTable];
else
rc = MAPISTORE_ERR_DENIED;
}