Home » Authentication » LiveUser » Bug #4396

[2005-05-21 01:56 UTC] prices at dflytech dot com

Description:
------------
readUserRights in Complex.php creates an array $result, and then merges it with $this->userRights. These arrays are of the form

array(
perm => level
)

However, array_merge is used which reindexes them. The rest of the code still expects them to be in perm => level form.

Reproduce code:
---------------
function readUserRights($permUserId)
{
$userRights = parent::readUserRights($permUserId);
$result = $this->_readImpliedRights($userRights, 'user');

if ($result) {
var_dump($result);
var_dump($this->userRights);
$this->userRights = array_merge($this->userRights, $result);
var_dump($result);
var_dump($this->userRights);

}
return $this->userRights;
} // end func readUserRights

Expected result:
----------------
array
4 => 1
6 => 1

array
4 => 1
6 => 1

array
4 => 1
6 => 1

array
4 => 1
6 => 1

Actual result:
--------------
array
4 => 1
6 => 1

array
4 => 1
6 => 1

array
4 => 1
6 => 1

array
0 => 1
1 => 1
2 => 1
3 => 1

This last array lost all of rights this user had. It allows him to go places he shouldn't be.

[2005-05-21 02:34 UTC] prices at dflytech dot com

To fix it, I did the following:

if ($result) {
// $this->userRights = array_merge($this->userRights, $result);
foreach($result as $key => $val)
{
$this->userRights[$key] = $val;
}
}

[2005-05-21 15:53 UTC] prices at dflytech dot com

Thanks for the quick response. I will just use my bandaid until the new code is released.

I will remember to check the CVS code next time.

Thanks.

Scott =)