From: Michael J. Rubinsky <mrubinsk@horde.org>
Date: Thu, 10 Sep 2009 14:26:20 +0000 (-0400)
Subject: Add basic permission checking to Kronolith::listResources()
X-Git-Url: https://git.internetallee.de/?a=commitdiff_plain;h=3108ddac250929b6237f299d53a96bcdea819272;p=horde.git

Add basic permission checking to Kronolith::listResources()
---

diff --git a/kronolith/lib/Kronolith.php b/kronolith/lib/Kronolith.php
index a7871be49..1d82f7c95 100644
--- a/kronolith/lib/Kronolith.php
+++ b/kronolith/lib/Kronolith.php
@@ -2028,15 +2028,15 @@ class Kronolith
     }
 
     /**
-     * Return a list of resources that the current user has access to administer.
+     * Return a list of resources that the current user has access to at the
+     * specified permission level. Right now, all users have PERMS_READ, but
+     * only system admins have PERMS_EDIT | PERMS_DELETE
      *
      * @return array of Kronolith_Resource objects
      */
-    static public function listResources($params = array())
+    static public function listResources($perms = PERMS_READ, $params = array())
     {
-        // For now, keep this check here. Maybe move this to the resource
-        // driver object?
-        if (!Horde_Auth::isAdmin()) {
+        if (($perms & (PERMS_EDIT | PERMS_DELETE)) && !Horde_Auth::isAdmin()) {
             return array();
         }