Making sure the input properties are validated before ACL check method is invoked (so ACLs are checked on validated inputs).

Author: krulis-martin

app/V1Module/presenters/base/BasePresenter.php

@@ -127,11 +127,11 @@ public function startup()
             $this->verifyUserIpLock($user);
         }
 
-        // ACL-checking method
-        $this->tryCall($this->formatPermissionCheckMethod($this->getAction()), $this->params);
-
         Validators::init();
         $this->processParams($actionReflection);
+
+        // ACL-checking method
+        $this->tryCall($this->formatPermissionCheckMethod($this->getAction()), $this->params);
     }
 
     protected function isRequestJson(): bool

tests/Presenters/ExercisesPresenter.phpt

@@ -1106,15 +1106,32 @@ class TestExercisesPresenter extends Tester\TestCase
         });
         $exercise = current($exercises);
 
+        $postBody = [
+            'version' => 1,
+            'difficulty' => 'super hard',
+            'isPublic' => false,
+            'localizedTexts' => [
+                [
+                    'locale' => 'cs',
+                    'text' => 'new descr',
+                    'name' => 'new name',
+                    'description' => 'some neaty description'
+                ]
+            ],
+            'solutionFilesLimit' => 3,
+            'solutionSizeLimit' => 42,
+            'mergeJudgeLogs' => false,
+        ];
+
         // another supervisor cannot update this exercise
         Assert::exception(
-            function () use ($exercise) {
+            function () use ($exercise, $postBody) {
                 PresenterTestHelper::performPresenterRequest(
                     $this->presenter,
                     'V1:Exercises',
                     'POST',
                     ['action' => 'updateDetail', 'id' => $exercise->getId()],
-                    []
+                    $postBody
                 );
             },
             ForbiddenRequestException::class
@@ -1130,22 +1147,7 @@ class TestExercisesPresenter extends Tester\TestCase
             'V1:Exercises',
             'POST',
             ['action' => 'updateDetail', 'id' => $exercise->getId()],
-            [
-                'version' => 1,
-                'difficulty' => 'super hard',
-                'isPublic' => false,
-                'localizedTexts' => [
-                    [
-                        'locale' => 'cs',
-                        'text' => 'new descr',
-                        'name' => 'new name',
-                        'description' => 'some neaty description'
-                    ]
-                ],
-                'solutionFilesLimit' => 3,
-                'solutionSizeLimit' => 42,
-                'mergeJudgeLogs' => false,
-            ]
+            $postBody
         );
         $response = $this->presenter->run($request);
         Assert::type(Nette\Application\Responses\JsonResponse::class, $response);

tests/Security/UserLocking.phpt

@@ -572,7 +572,7 @@ class UserLocking extends Tester\TestCase
                     'V1:Comments',
                     'POST',
                     ['action' => 'addComment', 'id' => $solution->getId()],
-                    ['text' => 'some comment text', 'isPrivate' => 'false']
+                    ['text' => 'some comment text', 'isPrivate' => false]
                 );
             },
             App\Exceptions\ForbiddenRequestException::class
@@ -610,7 +610,7 @@ class UserLocking extends Tester\TestCase
                     'V1:Comments',
                     'POST',
                     ['action' => 'addComment', 'id' => $solution->getId()],
-                    ['text' => 'some comment text', 'isPrivate' => 'false']
+                    ['text' => 'some comment text', 'isPrivate' => false]
                 );
             },
             App\Exceptions\ForbiddenRequestException::class
@@ -639,7 +639,7 @@ class UserLocking extends Tester\TestCase
                     'V1:Comments',
                     'POST',
                     ['action' => 'addComment', 'id' => $assignment->getId()],
-                    ['text' => 'some comment text', 'isPrivate' => 'false']
+                    ['text' => 'some comment text', 'isPrivate' => false]
                 );
             },
             App\Exceptions\ForbiddenRequestException::class
@@ -671,7 +671,7 @@ class UserLocking extends Tester\TestCase
                     'V1:Comments',
                     'POST',
                     ['action' => 'addComment', 'id' => $assignment->getId()],
-                    ['text' => 'some comment text', 'isPrivate' => 'false']
+                    ['text' => 'some comment text', 'isPrivate' => false]
                 );
             },
             App\Exceptions\ForbiddenRequestException::class