diff options
Diffstat (limited to 'plugins/ScheduledReports/API.php')
-rw-r--r-- | plugins/ScheduledReports/API.php | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/plugins/ScheduledReports/API.php b/plugins/ScheduledReports/API.php index e7771d1f8a..e5926e1b44 100644 --- a/plugins/ScheduledReports/API.php +++ b/plugins/ScheduledReports/API.php @@ -12,9 +12,11 @@ use Exception; use Piwik\Common; use Piwik\Date; use Piwik\Db; +use Piwik\NoAccessException; use Piwik\Piwik; use Piwik\Plugins\LanguagesManager\LanguagesManager; use Piwik\Plugins\SegmentEditor\API as APISegmentEditor; +use Piwik\Plugins\SitesManager\API as SitesManagerApi; use Piwik\ReportRenderer; use Piwik\ReportRenderer\Html; use Piwik\Site; @@ -288,8 +290,11 @@ class API extends \Piwik\Plugin\API $report = reset($reports); $idSite = $report['idsite']; + $login = $report['login']; $reportType = $report['type']; + $this->checkUserHasViewPermission($login, $idSite); + // override report period if (empty($period)) { $period = $report['period']; @@ -935,4 +940,19 @@ class API extends \Piwik\Plugin\API return $additionalFile; } + + private function checkUserHasViewPermission($login, $idSite) + { + if (empty($idSite)) { + return; + } + + $idSitesUserHasAccess = SitesManagerApi::getInstance()->getSitesIdWithAtLeastViewAccess($login); + + if (empty($idSitesUserHasAccess) + || !in_array($idSite, $idSitesUserHasAccess) + ) { + throw new NoAccessException(Piwik::translate('General_ExceptionPrivilege', array("'view'"))); + } + } } |