Problem/Motivation
The option has either the value 1 or 0, should be TRUE / FALSE instead
TRUE is "Allow the selected below" should be the other way around
When received from config we get a string ("0" / "1") this is very dangerous and the checks for this are completely incorrect:
$actionType = $this->config->get('negate');
$roles = array_filter($this->config->get('roles'));
$userRoles = $this->currentUser->getRoles();
if (isset($actionType) && !empty($roles) && !in_array('administrator', $userRoles)) {
if (($actionType && empty(array_intersect($roles, $userRoles))) || (!$actionType && !empty(array_intersect($roles, $userRoles)))) {
throw new AccessDeniedHttpException();
}
}
=> no need for "isset()" since it is always set and "if $actionType" will always result to true, because "0" as a string is TRUE.
Steps to reproduce
Proposed resolution
Fix this.
Comments
Comment #2
anybody@Grevil could you easily fix this and the tests?
Comment #3
anybodyFixed in #3558968: General Refactoring