From 6207c8f547a2157b30d4639cdb79c9802d4b6837 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Mon, 22 Nov 2021 11:22:56 +0200
Subject: [PATCH] attachment take into account field level

---
 .../Classes/Acl/Attachment/AccessChecker.php     | 16 ++++++++++++++++
 .../AclPortal/Attachment/AccessChecker.php       | 16 +++++++++++++++-
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/application/Espo/Classes/Acl/Attachment/AccessChecker.php b/application/Espo/Classes/Acl/Attachment/AccessChecker.php
index 9e42a3b21b..6b9bc736cf 100644
--- a/application/Espo/Classes/Acl/Attachment/AccessChecker.php
+++ b/application/Espo/Classes/Acl/Attachment/AccessChecker.php
@@ -32,6 +32,7 @@ namespace Espo\Classes\Acl\Attachment;
 use Espo\Entities\{
     User,
     Note,
+    Attachment,
 };
 
 use Espo\ORM\Entity;
@@ -45,6 +46,9 @@ use Espo\Core\{
     Acl\Traits\DefaultAccessCheckerDependency,
 };
 
+/**
+ * @implements AccessEntityCREDChecker<Attachment>
+ */
 class AccessChecker implements AccessEntityCREDChecker
 {
     use DefaultAccessCheckerDependency;
@@ -65,6 +69,8 @@ class AccessChecker implements AccessEntityCREDChecker
 
     public function checkEntityRead(User $user, Entity $entity, ScopeData $data): bool
     {
+        /** @var Attachment $entity */
+
         if ($entity->get('parentType') === 'Settings') {
             // Allow the logo.
             return true;
@@ -102,6 +108,16 @@ class AccessChecker implements AccessEntityCREDChecker
             }
         }
         else if ($this->aclManager->checkEntity($user, $parent)) {
+            if (
+                $entity->getTargetField() &&
+                in_array(
+                    $entity->getTargetField(),
+                    $this->aclManager->getScopeForbiddenFieldList($user, $parent->getEntityType())
+                )
+            ) {
+                return false;
+            }
+
             return true;
         }
 
diff --git a/application/Espo/Classes/AclPortal/Attachment/AccessChecker.php b/application/Espo/Classes/AclPortal/Attachment/AccessChecker.php
index ffb5e45446..e0cffee426 100644
--- a/application/Espo/Classes/AclPortal/Attachment/AccessChecker.php
+++ b/application/Espo/Classes/AclPortal/Attachment/AccessChecker.php
@@ -32,6 +32,7 @@ namespace Espo\Classes\AclPortal\Attachment;
 use Espo\Entities\{
     User,
     Note,
+    Attachment,
 };
 
 use Espo\ORM\Entity;
@@ -46,7 +47,7 @@ use Espo\Core\{
 };
 
 /**
- * @implements AccessEntityCREDChecker<User>
+ * @implements AccessEntityCREDChecker<Attachment>
  */
 class AccessChecker implements AccessEntityCREDChecker
 {
@@ -70,7 +71,10 @@ class AccessChecker implements AccessEntityCREDChecker
 
     public function checkEntityRead(User $user, Entity $entity, ScopeData $data): bool
     {
+        /** @var Attachment $entity */
+
         if ($entity->get('parentType') === 'Settings') {
+            // Allow the logo.
             return true;
         }
 
@@ -105,6 +109,16 @@ class AccessChecker implements AccessEntityCREDChecker
             }
         }
         else if ($this->aclManager->checkEntity($user, $parent)) {
+            if (
+                $entity->getTargetField() &&
+                in_array(
+                    $entity->getTargetField(),
+                    $this->aclManager->getScopeForbiddenFieldList($user, $parent->getEntityType())
+                )
+            ) {
+                return false;
+            }
+
             return true;
         }