mirror of https://github.com/MISP/MISP
fix: check also event.org_id when validating event ownership in order to fetch attributes
Fixes #1918pull/3995/head
parent
b253303edc
commit
32962184fa
|
@ -2898,7 +2898,7 @@ class Attribute extends AppModel
|
||||||
$params['group'] = empty($options['group']) ? $options['group'] : false;
|
$params['group'] = empty($options['group']) ? $options['group'] : false;
|
||||||
}
|
}
|
||||||
if (Configure::read('MISP.unpublishedprivate')) {
|
if (Configure::read('MISP.unpublishedprivate')) {
|
||||||
$params['conditions']['AND'][] = array('OR' => array('Event.published' => 1, 'Event.orgc_id' => $user['org_id']));
|
$params['conditions']['AND'][] = array('OR' => array('Event.published' => 1, 'Event.orgc_id' => $user['org_id'], 'Event.org_id' => $user['org_id']));
|
||||||
}
|
}
|
||||||
if (!empty($options['list'])) {
|
if (!empty($options['list'])) {
|
||||||
if (!empty($options['event_ids'])) {
|
if (!empty($options['event_ids'])) {
|
||||||
|
|
Loading…
Reference in New Issue