RBAC: Fix Access to Unsubscribe (ILIAS-eLearning#6514)

See: https://mantis.ilias.de/view.php?id=32243
klees · Dec 7, 2023 · ab56446 · ab56446
1 parent f2b8b0f
commit ab56446
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 5 deletions.
diff --git a/components/ILIAS/AccessControl/classes/class.ilAccess.php b/components/ILIAS/AccessControl/classes/class.ilAccess.php
@@ -510,7 +510,7 @@ public function doActivationCheck(
         int $a_obj_id,
         string $a_type
     ): bool {
-        $cache_perm = ($a_permission == "visible")
+        $cache_perm = ($a_permission === "visible" || $a_permission === 'leave')
             ? "visible"
             : "other";
 
@@ -519,7 +519,7 @@ public function doActivationCheck(
         }
 
         // nothings needs to be done if current permission is write permission
-        if ($a_permission == 'write') {
+        if ($a_permission === 'write') {
             return true;
         }
 
@@ -567,8 +567,9 @@ public function doActivationCheck(
             return true;
         }
 
-        // if current permission is visible and visible is set in activation
-        if ($a_permission == 'visible' && $item_data['visible']) {
+        // if current permission is visible or leave and visible is set in activation
+        if (($a_permission === 'visible' || $a_permission === 'leave')
+            && $item_data['visible']) {
             $this->ac_cache[$cache_perm][$a_ref_id][$a_user_id] = true;
             return true;
         }

diff --git a/components/ILIAS/Course/classes/class.ilObjCourseGUI.php b/components/ILIAS/Course/classes/class.ilObjCourseGUI.php
@@ -2392,6 +2392,7 @@ public function executeCommand(): void
                     && $cmd != 'deliverCertificate'
                     && $cmd != 'performUnsubscribe'
                     && $cmd != 'removeFromDesk'
+                    && $cmd !== 'leave'
                     && !$this->access->checkAccess("read", '', $this->object->getRefId())
                     || $cmd == 'join'
                     || $cmd == 'subscribe') {

diff --git a/components/ILIAS/Object/classes/class.ilObjectGUI.php b/components/ILIAS/Object/classes/class.ilObjectGUI.php
@@ -1563,8 +1563,16 @@ protected function checkPermission(string $perm, string $cmd = "", string $type
                 if ($perm != "create" && !is_object($this->object)) {
                     return;
                 }
-                throw new ilObjectException($this->lng->txt("permission_denied"));
+
+                ilSession::clear("il_rep_ref_id");
+
+                $this->tpl->setOnScreenMessage('failure', $this->lng->txt('msg_no_perm_read'), true);
+                $parent_ref_id = $this->tree->getParentNodeData($this->object->getRefId())['ref_id'];
+                $this->ctrl->redirectToURL(ilLink::_getLink($parent_ref_id));
             }
+
+            $this->tpl->setOnScreenMessage('failure', $this->lng->txt('msg_no_perm_read'), true);
+            self::_gotoRepositoryRoot();
         }
     }