From 24815e16087b4b1b64e9f380d45d411af32daf42 Mon Sep 17 00:00:00 2001
From: Simon Rettberg
Date: Mon, 9 Apr 2018 16:56:04 +0200
Subject: Permissions: Consistency: Make all pages require at least one
 permission to be accessible

Closes #3340
---
 modules-available/rebootcontrol/page.inc.php | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

(limited to 'modules-available/rebootcontrol/page.inc.php')

diff --git a/modules-available/rebootcontrol/page.inc.php b/modules-available/rebootcontrol/page.inc.php
index abbdb2c3..041ae74f 100644
--- a/modules-available/rebootcontrol/page.inc.php
+++ b/modules-available/rebootcontrol/page.inc.php
@@ -79,11 +79,14 @@ class Page_RebootControl extends Page
 				//location you want to see, default are "not  assigned" clients
 				$requestedLocation = Request::get('location', false, 'int');
 				$allowedLocs = User::getAllowedLocations("action.*");
+				if (empty($allowedLocs)) {
+					User::assertPermission('action.*');
+				}
 
 				if ($requestedLocation === false) {
 					if (in_array(0, $allowedLocs)) {
 						$requestedLocation = 0;
-					} elseif (!empty($allowedLocs)) {
+					} else {
 						$requestedLocation = reset($allowedLocs);
 					}
 				}
@@ -105,8 +108,8 @@ class Page_RebootControl extends Page
 				Render::addTemplate('header', $data);
 
 				// only fill table if user has at least one permission for the location
-				if ($requestedLocation === false) {
-					Message::addError('main.no-permission');
+				if (!in_array($requestedLocation, $allowedLocs)) {
+					Message::addError('locations.no-permission-location', $requestedLocation);
 				} else {
 					$data['data'] = RebootQueries::getMachineTable($requestedLocation);
 					Render::addTemplate('_page', $data);
-- 
cgit v1.2.3-55-g7522