Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security: ke_search indexer hook #87

Open
hmccloy opened this issue Jul 5, 2017 · 0 comments
Open

Security: ke_search indexer hook #87

hmccloy opened this issue Jul 5, 2017 · 0 comments

Comments

@hmccloy
Copy link

hmccloy commented Jul 5, 2017

There seems to be a problem with the ke_search indexer hook: Working with cascading fe_user groups, the permission check fails in modifyFileIndexEntryFromContentIndexer() and removes all groups, when the page or the content element is restricted to another usergroup than the storage is. As a result, the secure files are listed in the search result.

Code:
Line 81:
if ($feGroups) { $feGroups = implode( ',', GeneralUtility::keepItemsInArray(explode(',', $resourcePermissions), $feGroups) ); } else { $feGroups = $resourcePermissions; }

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant