From 33ec8d00413de23b24f74dcebe327bb1931776d2 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Sat, 17 Apr 2021 12:47:23 +0300
Subject: [PATCH] fix stream acl

---
 application/Espo/Services/Stream.php | 44 +++++++++++++++++++++-------
 1 file changed, 33 insertions(+), 11 deletions(-)

diff --git a/application/Espo/Services/Stream.php b/application/Espo/Services/Stream.php
index 0590501aff..60275b4295 100644
--- a/application/Espo/Services/Stream.php
+++ b/application/Espo/Services/Stream.php
@@ -50,6 +50,7 @@ use Espo\Core\{
     Utils\Metadata,
     Acl,
     AclManager,
+    Acl\Exceptions\NotImplemented as AclNotImplemented,
     ServiceFactory,
     Portal\AclManagerContainer as PortalAclManagerContainer,
     Utils\FieldUtil,
@@ -187,7 +188,14 @@ class Stream
                 continue;
             }
 
-            if (!$this->aclManager->check($user, $entity, 'stream')) {
+            try {
+                $hasAccess = $this->aclManager->checkEntityStream($user, $entity);
+            }
+            catch (AclNotImplemented $e) {
+                $hasAccess = false;
+            }
+
+            if (!$hasAccess) {
                 unset($userIdList[$i]);
             }
         }
@@ -261,22 +269,32 @@ class Stream
 
         if (!$skipAclCheck) {
             foreach ($userIdList as $i => $userId) {
-                $user = $this->entityManager->getRepository('User')
+                $user = $this->entityManager
+                    ->getRepository('User')
                     ->select(['id', 'type', 'isActive'])
                     ->where([
                         'id' => $userId,
                         'isActive' => true,
-                    ])->findOne();
+                    ])
+                    ->findOne();
 
                 if (!$user) {
                     unset($userIdList[$i]);
                     continue;
                 }
 
-                if (!$this->aclManager->check($user, $entity, 'stream')) {
+                try {
+                    $hasAccess = $this->aclManager->checkEntityStream($user, $entity);
+                }
+                catch (AclNotImplemented $e) {
+                    $hasAccess = false;
+                }
+
+                if (!$hasAccess) {
                     unset($userIdList[$i]);
                 }
             }
+
             $userIdList = array_values($userIdList);
         }
 
@@ -2002,13 +2020,17 @@ class Stream
                 continue;
             }
 
-            if (
-                !$aclManager
-                ||
-                !$aclManager->checkScope($user, $scope, 'read')
-                ||
-                !$aclManager->checkScope($user, $scope, 'stream')
-            ) {
+            try {
+                $hasAccess =
+                    $aclManager &&
+                    $aclManager->checkScope($user, $scope, 'read') &&
+                    $aclManager->checkScope($user, $scope, 'stream');
+            }
+            catch (AclNotImplemented $e) {
+                $hasAccess = false;
+            }
+
+            if (!$hasAccess) {
                 $ignoreScopeList[] = $scope;
             }
         }