silverstripe/sapphire — pull request #872 by chillu (2012-10-12 13:40:16+00:00)
Title: API File->canEdit() returns TRUE by default (not checking CMS perms)

This is a measure to support form fields and controllers
interacting with files in different contexts,
for example an UploadField used in a ModelAdmin,
or a website frontend. The check for 'CMS_ACCESS_AssetAdmin'
was too restricting. This wasn't a problem in 2.x simply because
the old FileField/Upload classes didn't respect File->can*() permissions.

This doesn't create a security issue as we're still securing core upload
fields by their controllers. The only field present in core is located
in CMSFileAddController, and indirectly through HTMLEditorField->MediaForm().

See discussion at https://groups.google.com/forum/?fromgroups=#!topic/silverstripe-dev/30CXT9csKFQ