diff --git a/src/app/document/controllers/DocumentController.php b/src/app/document/controllers/DocumentController.php index 838a885a401219eb0441f23c6fef279b7d2a34f3..7826d39d05620dcba304ced6bb17c3ff74326c87 100755 --- a/src/app/document/controllers/DocumentController.php +++ b/src/app/document/controllers/DocumentController.php @@ -132,21 +132,19 @@ class DocumentController public function getById(Request $request, Response $response, array $args) { - $queryParams = $request->getQueryParams(); - $queryParams['withDeleted'] = empty($queryParams['withDeleted']) ? false : $queryParams['withDeleted'] == 'true'; - if ($queryParams['withDeleted'] && !PrivilegeController::hasPrivilege(['userId' => $GLOBALS['id'], 'privilege' => 'can_purge'])) { - return $response->withStatus(403)->withJson(['errors' => 'Privilege forbidden']); - } - - if (!DocumentController::hasRightById(['id' => $args['id'], 'userId' => $GLOBALS['id'], 'withDeleted' => $queryParams['withDeleted']]) && !PrivilegeController::hasPrivilege(['userId' => $GLOBALS['id'], 'privilege' => 'manage_documents'])) { + if (!DocumentController::hasRightById(['id' => $args['id'], 'userId' => $GLOBALS['id'], 'withDeleted' => true]) && !PrivilegeController::hasPrivilege(['userId' => $GLOBALS['id'], 'privilege' => 'manage_documents'])) { return $response->withStatus(403)->withJson(['errors' => 'Document out of perimeter']); } - $document = DocumentModel::getById(['select' => ['*'], 'id' => $args['id'], 'withDeleted' => $queryParams['withDeleted']]); + $document = DocumentModel::getById(['select' => ['*'], 'id' => $args['id'], 'withDeleted' => true]); if (empty($document)) { return $response->withStatus(400)->withJson(['errors' => 'Document does not exist']); } + if ($document['status'] == 'DELETED' && !PrivilegeController::hasPrivilege(['userId' => $GLOBALS['id'], 'privilege' => 'can_purge'])) { + return $response->withStatus(403)->withJson(['errors' => 'Document does not exist']); + } + $adr = AdrModel::getDocumentsAdr([ 'select' => ['count(1)'], 'where' => ['main_document_id = ?', 'type != ?', 'type != ?', 'type != ?'],