fix: check acl

jdehaan · jdehaan · commit 6ead846180af · 2025-03-21T18:53:54.000+01:00
diff --git a/syntax/bpmnio.php b/syntax/bpmnio.php
@@ -93,6 +93,10 @@ private function buildAttributes($string)
 
     private function getMedia($src)
     {
+        if (!auth_quickaclcheck($src) >= AUTH_READ) {
+            return "Error: Access denied for file $src";
+        }
+
         $file = mediaFN($src);
 
         if (!file_exists($file) || !is_readable($file)) {

Original file line number	Diff line number	Diff line change
`@@ -93,6 +93,10 @@ private function buildAttributes($string)`
`93`	`93`
`94`	`94`	`private function getMedia($src)`
`95`	`95`	`{`
	`96`	`+ if (!auth_quickaclcheck($src) >= AUTH_READ) {`
	`97`	`+ return "Error: Access denied for file $src";`
	`98`	`+ }`
	`99`	`+`
`96`	`100`	`$file = mediaFN($src);`
`97`	`101`
`98`	`102`	`if (!file_exists($file) \|\| !is_readable($file)) {`