From 8916c83a8ef0baa05709dd3b71e7f26e706184fa Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Thu, 11 Aug 2016 13:25:01 +0200
Subject: [PATCH] check for access on op/op.Download.php in documentListRow()

---
 views/bootstrap/class.Bootstrap.php | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/views/bootstrap/class.Bootstrap.php b/views/bootstrap/class.Bootstrap.php
index dbdd09324..d61a74ee3 100644
--- a/views/bootstrap/class.Bootstrap.php
+++ b/views/bootstrap/class.Bootstrap.php
@@ -1942,6 +1942,7 @@ $(document).ready( function() {
 		$workflowmode = $this->params['workflowmode'];
 		$previewwidth = $this->params['previewWidthList'];
 		$enableClipboard = $this->params['enableclipboard'];
+		$accessop = $this->params['accessobject'];
 
 		$content = '';
 
@@ -1979,13 +1980,15 @@ $(document).ready( function() {
 
 			$content .= "<td>";
 			if (file_exists($dms->contentDir . $latestContent->getPath())) {
-				$content .= "<a draggable=\"false\" href=\"../op/op.Download.php?documentid=".$docID."&version=".$version."\">";
+				if($accessop->check_controller_access('Download', array('action'=>'run')))
+					$content .= "<a draggable=\"false\" href=\"../op/op.Download.php?documentid=".$docID."&version=".$version."\">";
 				if($previewer->hasPreview($latestContent)) {
 					$content .= "<img draggable=\"false\" class=\"mimeicon\" width=\"".$previewwidth."\"src=\"../op/op.Preview.php?documentid=".$document->getID()."&version=".$latestContent->getVersion()."&width=".$previewwidth."\" title=\"".htmlspecialchars($latestContent->getMimeType())."\">";
 				} else {
 					$content .= "<img draggable=\"false\" class=\"mimeicon\" src=\"".$this->getMimeIcon($latestContent->getFileType())."\" title=\"".htmlspecialchars($latestContent->getMimeType())."\">";
 				}
-				$content .= "</a>";
+				if($accessop->check_controller_access('Download', array('action'=>'run')))
+					$content .= "</a>";
 			} else
 				$content .= "<img draggable=\"false\" class=\"mimeicon\" src=\"".$this->getMimeIcon($latestContent->getFileType())."\" title=\"".htmlspecialchars($latestContent->getMimeType())."\">";
 			$content .= "</td>";