TT#35058 Apply write access checking for subscriberadin on subscribers API

Change-Id: I0700ea80026bfb959d240b7ed67c88d5a9385ad9
8 years ago · f103d31d8a
parent e5e975d0ab
commit f103d31d8a
1 changed files with 8 additions and 3 deletions
--- a/lib/NGCP/Panel/Role/API/Subscribers.pm
+++ b/lib/NGCP/Panel/Role/API/Subscribers.pm
@ -829,7 +829,12 @@ sub update_item {
 sub check_write_access {
    my($self, $c) = @_;
    if($c->user->roles eq "admin" || $c->user->roles eq "reseller") {
-    } elsif($c->user->roles eq "subscriber") {
+    } elsif($c->user->roles eq "subscriber"
+        || (
+              $c->user->roles eq "subscriberadmin"
+            && !$self->subscriberadmin_write_access($c)
+        )
+    ) {
        $self->error($c, HTTP_FORBIDDEN, "Read-only resource for authenticated role");
        return;
    } elsif($c->user->roles eq "subscriberadmin") {