diff --git a/accesrestreint_pipelines.php b/accesrestreint_pipelines.php index 775a3964fff55cca1ed139aea5ac9a641f4536c9..d7ffda78b7b8b8edaa17be2db4dd198dd416fd1d 100644 --- a/accesrestreint_pipelines.php +++ b/accesrestreint_pipelines.php @@ -105,7 +105,7 @@ function accesrestreint_page_indisponible($contexte) { } include_spip('inc/autoriser'); - if ($publie and !autoriser('voir', $objet, $id)) { + if ($publie and !autoriser('voir', $objet, $id, null, $objet === 'document' ? ['htaccess' => true]: [])) { // c'est un contenu restreint $contexte['status'] = '401'; $contexte['code'] = '401 Unauthorized'; diff --git a/action/api_docrestreint.php b/action/api_docrestreint.php index e93d8ac5ad48b326207e909916e8441bafc7080f..b9b0c190e8d2c76f917cce53dfc2324cdfd6f470 100644 --- a/action/api_docrestreint.php +++ b/action/api_docrestreint.php @@ -450,7 +450,7 @@ class Accesrestreint_document { include_spip('inc/autoriser'); } - if (!autoriser('voir', 'document', $doc['id_document'])) { + if (!autoriser('voir', 'document', $doc['id_document'], null, ['htaccess' => true])) { spip_log('acces interdit, pas autorise a voir le document #' . $doc['id_document'] . ' : ' . $this->_fichier, 'accesrestreint'); return false; } diff --git a/action/autoriser.php b/action/autoriser.php index ded7c8dc7ad9b76ed2c8536d905e3cb49832fb9e..216c4567bb6db793a60525df6bc1c7fcdfeff254 100644 --- a/action/autoriser.php +++ b/action/autoriser.php @@ -24,7 +24,7 @@ function action_autoriser_dist() { $arg = intval(_request('arg')); if ( - !autoriser('voir', 'document', $arg) + !autoriser('voir', 'document', $arg, null, ['htaccess' => true]) or !($row = sql_fetsel('fichier', 'spip_documents', 'id_document=' . intval($arg))) or !($file = $row['fichier']) or !(file_exists($file))