From fc7e2400cf6076cf66d914e2910f7bf18e719b69 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Fri, 30 Apr 2021 13:38:01 +0300
Subject: [PATCH] acl always do checkScope

---
 application/Espo/Core/AclManager.php | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/application/Espo/Core/AclManager.php b/application/Espo/Core/AclManager.php
index c51640579f..f1c1004a15 100644
--- a/application/Espo/Core/AclManager.php
+++ b/application/Espo/Core/AclManager.php
@@ -193,11 +193,13 @@ class AclManager
 
     /**
      * Get an access level for a specific scope and action.
-     *
-     * @todo Use LevelProvider?
      */
     public function getLevel(User $user, string $scope, string $action): string
     {
+        if (!$this->checkScope($user, $scope)) {
+            return Table::LEVEL_NO;
+        }
+
         $data = $this->getTable($user)->getScopeData($scope);
 
         return $data->get($action);
@@ -281,6 +283,10 @@ class AclManager
     {
         $scope = $entity->getEntityType();
 
+        if (!$this->checkScope($user, $scope)) {
+            return false;
+        }
+
         $data = $this->getTable($user)->getScopeData($scope);
 
         $checker = $this->getAccessChecker($scope);
@@ -395,6 +401,10 @@ class AclManager
      */
     public function checkScope(User $user, string $scope, ?string $action = null): bool
     {
+        if ($action && !$this->checkScope($user, $scope)) {
+            return false;
+        }
+
         $data = $this->getTable($user)->getScopeData($scope);
 
         $checker = $this->getAccessChecker($scope);