search

ops-itop / itop-extensions

my extensions of itop
30 stars 12 forks source link

lnkContactToApplicationSolution更新bug #28

Closed annProg closed 8 years ago

annProg commented 8 years ago

DoCheckToWrite函数

            $myContactId = UserRights::GetContactId();
            $thisContactId = $this->Get('contact_id');

            if ($myContactId != $thisContactId && !UserRights::IsAdministrator()){
                $this->m_aCheckIssues[] = Dict::Format("Class:lnkContactToApplicationSolution/Error:CanOnlyAddLinkForYourself", $thisContactName);
            }

有漏洞，用户可以把其他人的关联更改为自己的关联，$this->Get('')获取的是当前form的值，不是数据库中的值.

简单的处理办法是不允许更新链接类，只允许增加和删除链接。