From c032541f690b755cbb093940bc7000107dfec7db Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Wed, 31 Mar 2021 13:11:43 +0300
Subject: [PATCH] followers portal access check

---
 application/Espo/Services/Record.php | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/application/Espo/Services/Record.php b/application/Espo/Services/Record.php
index e0c054dc0e..ea95377506 100644
--- a/application/Espo/Services/Record.php
+++ b/application/Espo/Services/Record.php
@@ -1975,6 +1975,10 @@ class Record implements Crud,
             throw new Forbidden("No 'read' access to user.");
         }
 
+        if ($user->isPortal() && !$this->getAcl()->get('portal')) {
+            throw new Forbidden("No 'portal' permission.");
+        }
+
         $result = $this->getStreamService()->followEntity($entity, $foreignId);
 
         if (!$result) {
@@ -2012,11 +2016,14 @@ class Record implements Crud,
             throw new Forbidden("No 'read' access to user.");
         }
 
+        if ($user->isPortal() && !$this->getAcl()->get('portal')) {
+            throw new Forbidden("No 'portal' permission.");
+        }
+
         if (!$this->getUser()->isAdmin()) {
             throw new Forbidden();
         }
 
-
         $this->getStreamService()->unfollowEntity($entity, $foreignId);
     }