From 20f5bd6489be3778e1305db1772b1ee9b1e809b1 Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Thu, 11 Aug 2016 13:25:27 +0200
Subject: [PATCH] check for access on Download and ViewOnline

---
 views/bootstrap/class.DocumentVersionDetail.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/views/bootstrap/class.DocumentVersionDetail.php b/views/bootstrap/class.DocumentVersionDetail.php
index bc86c6c52..0588c5df4 100644
--- a/views/bootstrap/class.DocumentVersionDetail.php
+++ b/views/bootstrap/class.DocumentVersionDetail.php
@@ -42,6 +42,7 @@ class SeedDMS_View_DocumentVersionDetail extends SeedDMS_Bootstrap_Style {
 		$folder = $this->params['folder'];
 		$document = $this->params['document'];
 		$version = $this->params['version'];
+		$accessop = $this->params['accessobject'];
 		$viewonlinefiletypes = $this->params['viewonlinefiletypes'];
 		$enableversionmodification = $this->params['enableversionmodification'];
 		$cachedir = $this->params['cachedir'];
@@ -188,9 +189,11 @@ class SeedDMS_View_DocumentVersionDetail extends SeedDMS_Bootstrap_Style {
 		//if (($document->getAccessMode($user) >= M_READWRITE)) {
 		print "<ul class=\"actions unstyled\">";
 		if ($file_exists){
-			print "<li><a href=\"../op/op.Download.php?documentid=".$document->getID()."&version=".$version->getVersion()."\" title=\"".htmlspecialchars($version->getMimeType())."\"><i class=\"icon-download\"></i> ".getMLText("download")."</a>";
+			if($accessop->check_controller_access('Download', array('action'=>'run')))
+				print "<li><a href=\"../op/op.Download.php?documentid=".$document->getID()."&version=".$version->getVersion()."\" title=\"".htmlspecialchars($version->getMimeType())."\"><i class=\"icon-download\"></i> ".getMLText("download")."</a>";
 			if ($viewonlinefiletypes && in_array(strtolower($version->getFileType()), $viewonlinefiletypes))
-				print "<li><a target=\"_blank\" href=\"../op/op.ViewOnline.php?documentid=".$document->getID()."&version=".$version->getVersion()."\"><i class=\"icon-star\"></i> " . getMLText("view_online") . "</a>";
+				if($accessop->check_controller_access('ViewOnline', array('action'=>'run')))
+					print "<li><a target=\"_blank\" href=\"../op/op.ViewOnline.php?documentid=".$document->getID()."&version=".$version->getVersion()."\"><i class=\"icon-star\"></i> " . getMLText("view_online") . "</a>";
 			print "</ul>";
 			print "<ul class=\"actions unstyled\">";
 		}
@@ -362,6 +365,7 @@ class SeedDMS_View_DocumentVersionDetail extends SeedDMS_Bootstrap_Style {
 		}
 ?>
 </div>
+</div>
 <?php
 		$this->contentEnd();
 		$this->htmlEndPage();