Correctly check the permission to move child records as non-admin user

Author: leofeyer

system/docs/CHANGELOG.md

@@ -1,6 +1,13 @@
 Contao Open Source CMS changelog
 ================================
 
+Version 3.5.38 (2018-12-XX)
+---------------------------
+
+### Fixed
+Correctly check the permission to move child records as non-admin user.
+
+
 Version 3.5.37 (2018-12-13)
 ---------------------------
 

system/modules/calendar/dca/tl_calendar_events.php

@@ -560,7 +560,7 @@ public function checkPermission()
 		{
 			case 'paste':
 			case 'select':
-				if (!in_array($id, $root))
+				if (!in_array(CURRENT_ID, $root)) // check CURRENT_ID here (see #247)
 				{
 					$this->log('Not enough permissions to access calendar ID "'.$id.'"', __METHOD__, TL_ERROR);
 					$this->redirect('contao/main.php?act=error');

system/modules/core/dca/tl_form_field.php

@@ -467,7 +467,7 @@ public function checkPermission()
 		{
 			case 'paste':
 			case 'select':
-				if (!in_array($id, $root))
+				if (!in_array(CURRENT_ID, $root)) // check CURRENT_ID here (see #247)
 				{
 					$this->log('Not enough permissions to access form ID "'.$id.'"', __METHOD__, TL_ERROR);
 					$this->redirect('contao/main.php?act=error');

system/modules/news/dca/tl_news.php

@@ -508,7 +508,7 @@ public function checkPermission()
 		{
 			case 'paste':
 			case 'select':
-				if (!in_array($id, $root))
+				if (!in_array(CURRENT_ID, $root)) // check CURRENT_ID here (see #247)
 				{
 					$this->log('Not enough permissions to access news archive ID "'.$id.'"', __METHOD__, TL_ERROR);
 					$this->redirect('contao/main.php?act=error');

system/modules/newsletter/dca/tl_newsletter.php

@@ -310,7 +310,7 @@ public function checkPermission()
 		{
 			case 'paste':
 			case 'select':
-				if (!in_array($id, $root))
+				if (!in_array(CURRENT_ID, $root)) // check CURRENT_ID here (see #247)
 				{
 					$this->log('Not enough permissions to access newsletter channel ID "'.$id.'"', __METHOD__, TL_ERROR);
 					$this->redirect('contao/main.php?act=error');

system/modules/newsletter/dca/tl_newsletter_recipients.php

@@ -246,7 +246,7 @@ public function checkPermission()
 		{
 			case 'paste':
 			case 'select':
-				if (!in_array($id, $root))
+				if (!in_array(CURRENT_ID, $root)) // check CURRENT_ID here (see #247)
 				{
 					$this->log('Not enough permissions to access newsletter channel ID "'.$id.'"', __METHOD__, TL_ERROR);
 					$this->redirect('contao/main.php?act=error');