code_allowed is a real mess. Start the cleanup by remving the account level code allow and limiting to specific channels only. This reduces the possibility of cross channel security issues coming into play. Then provide a single function for checking the code permission. This is only partially done as we often need to check against the observer or logged in channel as well as the resource owner to ensure that this only returns true for local channels which also own the requested resource.

This commit is contained in:
zotlabs
2017-03-13 16:19:47 -07:00
committed by Mario Vavti
parent 107083e3e4
commit 0f7832dc30
7 changed files with 28 additions and 78 deletions

View File

@@ -2247,3 +2247,20 @@ function channel_remove($channel_id, $local = true, $unset_session=false) {
}
}
/*
* This checks if a channel is allowed to publish executable code.
* It is up to the caller to determine if the observer or local_channel
* is in fact the resource owner whose channel_id is being checked
*/
function channel_codeallowed($channel_id) {
if(! intval($channel_id))
return false;
$x = channelx_by_n($channel_id);
if(($x) && ($x['channel_pageflags'] & PAGE_ALLOWCODE))
return true;
return false;
}