Extension Permission Issue... v 3.0.3.8

Code: Select all

<?php
class ControllerStartupPermission extends Controller {
	public function index() {
		if (isset($this->request->get['route'])) {
			$route = '';

			$part = explode('/', $this->request->get['route']);

			// New Code - Check if route is File or Function call.
			$i = 0;
			$arrayLength = count($part);
			$filename = DIR_APPLICATION . "controller/" . $this->request->get['route'] . ".php";
			if (!file_exists($filename)) {
				$arrayLength = $arrayLength - 1;
			}
			$permission_check_route = $part[0];;
			for ($i = 1; $i < $arrayLength; $i++) {
				$permission_check_route .= "/" . $part[$i] ;
			}
			// End New Code.

			if (isset($part[0])) {
				$route .= $part[0];
			}

			if (isset($part[1])) {
				$route .= '/' . $part[1];
			}

			// If a 3rd part is found we need to check if its under one of the extension folders.
			$extension = array(
				'extension/advertise',
				'extension/dashboard',
				'extension/analytics',
				'extension/captcha',
				'extension/extension',
				'extension/feed',
				'extension/fraud',
				'extension/module',
				'extension/payment',
				'extension/shipping',
				'extension/theme',
				'extension/total',
				'extension/report'
			);

			if (isset($part[2]) && in_array($route, $extension)) {
				$route .= '/' . $part[2];
			}

			// We want to ingore some pages from having its permission checked.
			$ignore = array(
				'common/dashboard',
				'common/login',
				'common/logout',
				'common/forgotten',
				'common/reset',
				'error/not_found',
				'error/permission'
			);

			if (!in_array($route, $ignore) && !$this->user->hasPermission('access', $permission_check_route ) {
				return new Action('error/permission');
			}
		}
	}
}