From 5a3c72a8378977ca99980e779e72b3cd0f6edfdd Mon Sep 17 00:00:00 2001 From: Robert Munteanu Date: Fri, 31 Jul 2009 12:30:38 +0300 Subject: [PATCH] Avoid unconditionally referencing project_id The SOAP api mc_file_get function unconditionally references $row['project_id'], but that field is only set for 'doc' attachments. That access is now guarded by if checks, to avoid system notices and thus errors being sent to the SOAP client. --- api/soap/mc_file_api.php | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/api/soap/mc_file_api.php b/api/soap/mc_file_api.php index b40242d..90df93f 100644 --- a/api/soap/mc_file_api.php +++ b/api/soap/mc_file_api.php @@ -160,7 +160,9 @@ function mci_file_get( $p_file_id, $p_type, $p_user_id ) { $row = db_fetch_array( $result ); $t_bug_id = $row['bug_id']; - $t_project_id = $row['project_id']; + if ( $p_type == 'doc' ) { + $t_project_id = $row['project_id']; + } $t_diskfile = $row['diskfile']; $t_content = base64_encode( $row['content'] ); @@ -177,7 +179,7 @@ function mci_file_get( $p_file_id, $p_type, $p_user_id ) { if( OFF == config_get( 'enable_project_documentation' ) ) { return new soap_fault( 'Client', '', 'Access Denied' ); } - if( !access_has_project_level( config_get( 'view_proj_doc_threshold' ), $t_project_id, $p_user_id ) ) { + if( $p_type == 'doc' && !access_has_project_level( config_get( 'view_proj_doc_threshold' ), $t_project_id, $p_user_id ) ) { return new soap_fault( 'Client', '', 'Access Denied' ); } break; -- 1.6.3.3