From c9a6bd2d6423b9971ab71cc77c33f79b8b31f435 Mon Sep 17 00:00:00 2001
From: yuri <yurikuzn@users.noreply.github.com>
Date: Wed, 9 Jan 2019 13:35:03 +0200
Subject: [PATCH] select manager check link restricted

---
 application/Espo/Core/Acl.php                 |  5 +++++
 application/Espo/Core/AclManager.php          | 16 ++++++++++++++++
 application/Espo/Core/SelectManagers/Base.php |  7 +++++++
 3 files changed, 28 insertions(+)

diff --git a/application/Espo/Core/Acl.php b/application/Espo/Core/Acl.php
index e2781a893c..66b73e92bd 100644
--- a/application/Espo/Core/Acl.php
+++ b/application/Espo/Core/Acl.php
@@ -124,6 +124,11 @@ class Acl
         return $this->getAclManager()->getScopeForbiddenFieldList($this->getUser(), $scope, $action, $thresholdLevel);
     }
 
+    public function getScopeForbiddenLinkList($scope, $action = 'read', $thresholdLevel = 'no')
+    {
+        return $this->getAclManager()->getScopeForbiddenLinkList($this->getUser(), $scope, $action, $thresholdLevel);
+    }
+
     public function checkUserPermission($target, $permissionType = 'userPermission')
     {
         return $this->getAclManager()->checkUserPermission($this->getUser(), $target, $permissionType);
diff --git a/application/Espo/Core/AclManager.php b/application/Espo/Core/AclManager.php
index 296cbb1574..679b6f3b5d 100644
--- a/application/Espo/Core/AclManager.php
+++ b/application/Espo/Core/AclManager.php
@@ -309,6 +309,22 @@ class AclManager
         return $list;
     }
 
+
+    public function getScopeForbiddenLinkList(User $user, $scope, $action = 'read', $thresholdLevel = 'no')
+    {
+        $list = [];
+
+        if ($thresholdLevel === 'no') {
+            $list = array_merge(
+                $list,
+                $this->getScopeRestrictedLinkList($scope, $this->getGlobalRestrictionTypeList($user, $action))
+            );
+            $list = array_values($list);
+        }
+
+        return $list;
+    }
+
     public function checkUserPermission(User $user, $target, $permissionType = 'userPermission')
     {
         $permission = $this->get($user, $permissionType);
diff --git a/application/Espo/Core/SelectManagers/Base.php b/application/Espo/Core/SelectManagers/Base.php
index c41479a81e..4e661f53c9 100644
--- a/application/Espo/Core/SelectManagers/Base.php
+++ b/application/Espo/Core/SelectManagers/Base.php
@@ -787,6 +787,13 @@ class Base
                     if (in_array($attribute, $this->getAcl()->getScopeForbiddenFieldList($this->getEntityType()))) {
                         throw new Forbidden();
                     }
+                    if (
+                        $this->getSeed()->hasRelation($attribute)
+                        &&
+                        in_array($attribute, $this->getAcl()->getScopeForbiddenLinkList($this->getEntityType()))
+                    ) {
+                        throw new Forbidden();
+                    }
                 } else {
                     if (in_array($attribute, $this->getAcl()->getScopeForbiddenAttributeList($this->getEntityType()))) {
                         throw new Forbidden();