Fix: #4081 - UPLOAD_MEDIA setting is ignored

1 files changed, 14 insertions, 6 deletions

diff --git a/app/Http/RequestHandlers/AddNewFact.php b/app/Http/RequestHandlers/AddNewFact.php
index 09e0bdef54..f2b248e91c 100644
--- a/app/Http/RequestHandlers/AddNewFact.php
+++ b/app/Http/RequestHandlers/AddNewFact.php
@@ -21,8 +21,10 @@ namespace Fisharebest\Webtrees\Http\RequestHandlers;
 
 use Fisharebest\Webtrees\Auth;
 use Fisharebest\Webtrees\Fact;
+use Fisharebest\Webtrees\Http\Exceptions\HttpAccessDeniedException;
 use Fisharebest\Webtrees\Http\ViewResponseTrait;
 use Fisharebest\Webtrees\Registry;
+use Fisharebest\Webtrees\Services\AuthorizationService;
 use Fisharebest\Webtrees\Services\GedcomEditService;
 use Fisharebest\Webtrees\Tree;
 use Psr\Http\Message\ResponseInterface;
@@ -41,16 +43,20 @@ class AddNewFact implements RequestHandlerInterface
 {
     use ViewResponseTrait;
 
+    private AuthorizationService $authorization_service;
+
     private GedcomEditService $gedcom_edit_service;
 
     /**
      * AddNewFact constructor.
      *
-     * @param GedcomEditService $gedcom_edit_service
+     * @param AuthorizationService $authorization_service
+     * @param GedcomEditService    $gedcom_edit_service
      */
-    public function __construct(GedcomEditService $gedcom_edit_service)
+    public function __construct(AuthorizationService $authorization_service, GedcomEditService $gedcom_edit_service)
     {
-        $this->gedcom_edit_service = $gedcom_edit_service;
+        $this->authorization_service = $authorization_service;
+        $this->gedcom_edit_service   = $gedcom_edit_service;
     }
 
     /**
@@ -63,10 +69,12 @@ class AddNewFact implements RequestHandlerInterface
         $tree = $request->getAttribute('tree');
         assert($tree instanceof Tree);
 
-        $xref = $request->getAttribute('xref');
-        assert(is_string($xref));
+        $xref   = (string) $request->getAttribute('xref');
+        $subtag = (string) $request->getAttribute('fact');
 
-        $subtag = $request->getAttribute('fact');
+        if ($subtag === 'OBJE' && !$this->authorization_service->canUploadMedia($tree, Auth::user())) {
+            throw new HttpAccessDeniedException();
+        }
 
         $include_hidden = (bool) ($request->getQueryParams()['include_hidden'] ?? false);