Merge pull request #4015 from Countly/user-rights-accessibility-fix

Added undefined check to user parameters

Author: Cookiezaurs

api/utils/rights.js

@@ -1012,19 +1012,31 @@ exports.hasAdminAccess = function(member, app_id) {
 };
 
 exports.hasCreateRight = function(feature, app_id, member) {
-    return member.global_admin || member.permission.c[app_id].allowed[feature] || member.permission.c[app_id].all;
+    var hasAppSpecificRight = (member.permission && member.permission.c && member.permission.c[app_id] && member.permission.c[app_id].allowed[feature]);
+    var hasGlobalAdminRight = member.global_admin;
+    var hasAppAdminRight = member.permission && member.permission.c && member.permission.c[app_id] && member.permission.c[app_id].all;
+    return hasAppSpecificRight || hasGlobalAdminRight || hasAppAdminRight;
 };
 
 exports.hasReadRight = function(feature, app_id, member) {
-    return member.global_admin || member.permission.r[app_id].allowed[feature] || member.permission.r[app_id].all;
+    var hasAppSpecificRight = (member.permission && member.permission.r && member.permission.r[app_id] && member.permission.r[app_id].allowed[feature]);
+    var hasGlobalAdminRight = member.global_admin;
+    var hasAppAdminRight = member.permission && member.permission.r && member.permission.r[app_id] && member.permission.r[app_id].all;
+    return hasAppSpecificRight || hasGlobalAdminRight || hasAppAdminRight;
 };
 
 exports.hasUpdateRight = function(feature, app_id, member) {
-    return member.global_admin || member.permission.u[app_id].allowed[feature] || member.permission.u[app_id].all;
+    var hasAppSpecificRight = (member.permission && member.permission.u && member.permission.u[app_id] && member.permission.u[app_id].allowed[feature]);
+    var hasGlobalAdminRight = member.global_admin;
+    var hasAppAdminRight = member.permission && member.permission.u && member.permission.u[app_id] && member.permission.u[app_id].all;
+    return hasAppSpecificRight || hasGlobalAdminRight || hasAppAdminRight;
 };
 
 exports.hasDeleteRight = function(feature, app_id, member) {
-    return member.global_admin || member.permission.d[app_id].allowed[feature] || member.permission.d[app_id].all;
+    var hasAppSpecificRight = (member.permission && member.permission.d && member.permission.d[app_id] && member.permission.d[app_id].allowed[feature]);
+    var hasGlobalAdminRight = member.global_admin;
+    var hasAppAdminRight = member.permission && member.permission.d && member.permission.d[app_id] && member.permission.d[app_id].all;
+    return hasAppSpecificRight || hasGlobalAdminRight || hasAppAdminRight;
 };
 
 exports.getUserApps = function(member) {