Problem/Motivation

The option has either the value 1 or 0, should be TRUE / FALSE instead
TRUE is "Allow the selected below" should be the other way around
When received from config we get a string ("0" / "1") this is very dangerous and the checks for this are completely incorrect:

      $actionType = $this->config->get('negate');
      $roles = array_filter($this->config->get('roles'));
      $userRoles = $this->currentUser->getRoles();
      if (isset($actionType) && !empty($roles) && !in_array('administrator', $userRoles)) {
        if (($actionType && empty(array_intersect($roles, $userRoles))) || (!$actionType && !empty(array_intersect($roles, $userRoles)))) {
          throw new AccessDeniedHttpException();
        }
      }

=> no need for "isset()" since it is always set and "if $actionType" will always result to true, because "0" as a string is TRUE.

Steps to reproduce

Proposed resolution

Fix this.

Remaining tasks

User interface changes

API changes

Data model changes

Comments

grevil created an issue. See original summary.

anybody’s picture

Assigned: Unassigned » grevil
Status: Active » Needs work

@Grevil could you easily fix this and the tests?

anybody’s picture

Assigned: grevil » Unassigned
Status: Needs work » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.