From 928759f66366dc82d55e892324e52f565b2676e0 Mon Sep 17 00:00:00 2001 From: "Marco A. Nina Mena" Date: Mon, 7 Aug 2017 08:37:04 -0400 Subject: [PATCH 1/2] HOR-3432 ProcessMaker User Privilege Escalation - Add validation user access with PM_USERS --- workflow/engine/methods/roles/roles_Ajax.php | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/workflow/engine/methods/roles/roles_Ajax.php b/workflow/engine/methods/roles/roles_Ajax.php index b13937140..19e6fa8f7 100644 --- a/workflow/engine/methods/roles/roles_Ajax.php +++ b/workflow/engine/methods/roles/roles_Ajax.php @@ -21,6 +21,20 @@ * For more information, contact Colosa Inc, 2566 Le Jeune Rd., * Coral Gables, FL, 33134, USA, or email info@colosa.com. */ +global $RBAC; +switch ($RBAC->userCanAccess( 'PM_USERS' )) { + case - 2: + G::SendTemporalMessage( 'ID_USER_HAVENT_RIGHTS_SYSTEM', 'error', 'labels' ); + G::header( 'location: ../login/login' ); + die(); + break; + case - 1: + case - 3: + G::SendTemporalMessage( 'ID_USER_HAVENT_RIGHTS_PAGE', 'error', 'labels' ); + G::header( 'location: ../login/login' ); + die(); + break; +} $REQUEST = (isset( $_GET['request'] )) ? $_GET['request'] : $_POST['request']; From a0c0bcf6e6bd96bee3fdfa7a715b29ba1b1a63d7 Mon Sep 17 00:00:00 2001 From: "Marco A. Nina Mena" Date: Mon, 7 Aug 2017 11:58:16 -0400 Subject: [PATCH 2/2] Change method of throw --- workflow/engine/methods/roles/roles_Ajax.php | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/workflow/engine/methods/roles/roles_Ajax.php b/workflow/engine/methods/roles/roles_Ajax.php index 19e6fa8f7..d3ad0ab43 100644 --- a/workflow/engine/methods/roles/roles_Ajax.php +++ b/workflow/engine/methods/roles/roles_Ajax.php @@ -21,18 +21,16 @@ * For more information, contact Colosa Inc, 2566 Le Jeune Rd., * Coral Gables, FL, 33134, USA, or email info@colosa.com. */ +use ProcessMaker\Exception\RBACException; + global $RBAC; -switch ($RBAC->userCanAccess( 'PM_USERS' )) { - case - 2: - G::SendTemporalMessage( 'ID_USER_HAVENT_RIGHTS_SYSTEM', 'error', 'labels' ); - G::header( 'location: ../login/login' ); - die(); +switch ($RBAC->userCanAccess('PM_USERS')) { + case -2: + throw new RBACException('ID_USER_HAVENT_RIGHTS_SYSTEM', -2); break; - case - 1: - case - 3: - G::SendTemporalMessage( 'ID_USER_HAVENT_RIGHTS_PAGE', 'error', 'labels' ); - G::header( 'location: ../login/login' ); - die(); + case -1: + case -3: + throw new RBACException('ID_USER_HAVENT_RIGHTS_PAGE', -1); break; }