Index: branches/RC/core/kernel/db/db_event_handler.php =================================================================== diff -u -N -r10356 -r10417 --- branches/RC/core/kernel/db/db_event_handler.php (.../db_event_handler.php) (revision 10356) +++ branches/RC/core/kernel/db/db_event_handler.php (.../db_event_handler.php) (revision 10417) @@ -2141,24 +2141,33 @@ $cookie_name = 'adm_'.$this->Application->ConfigValue('SessionCookieName'); $this->Application->HttpQuery->Cookie['cookies_on'] = 1; $this->Application->HttpQuery->Cookie[$cookie_name] = $this->Application->GetVar('flashsid'); + $this->Application->HttpQuery->Cookie[$cookie_name.'_live'] = $this->Application->GetVar('flashsid'); // this prevents session from auto-expiring when KeepSessionOnBrowserClose & FireFox is used $admin_ses =& $this->Application->recallObject('Session.admin'); /* @var $admin_ses Session */ + $user = $admin_ses->RecallVar('user_id'); + $perm_helper =& $this->Application->recallObject('PermissionsHelper'); /* @var $perm_helper kPermissionsHelper */ + $section = $event->getSection(); + if (!$perm_helper->CheckUserPermission($user, $section.'.add') && !$perm_helper->CheckUserPermission($user, $section.'.edit')) { $event->status = erPERM_FAIL; header('HTTP/1.0 403 You don\'t have permissions to upload'); exit; return; } - if (!$cookie_name) $cookie_name = 'sid'; + if (!$cookie_name) { + $cookie_name = 'sid'; + } $value = $this->Application->GetVar('Filedata'); - if (!$value) return ; + if (!$value) { + return ; + } $tmp_path = defined('WRITEABLE') ? WRITEABLE.'/tmp/' : FULL_PATH.'/kernel/cache/'; $fname = $value['name'];