From 1946bd308f92e60b55db0487ab3f111d94566fba Mon Sep 17 00:00:00 2001
From: Danu Widatama <widatama@gmail.com>
Date: Mon, 30 Oct 2023 13:25:37 +0700
Subject: [PATCH] Add feature check in rights

---
 api/utils/rights.js | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/api/utils/rights.js b/api/utils/rights.js
index 2daa5e49efb..af1a439df5b 100644
--- a/api/utils/rights.js
+++ b/api/utils/rights.js
@@ -714,10 +714,12 @@ exports.validateRead = function(params, feature, callback, callbackParam) {
                         }
                         else {
                             isFeatureAllowedInReadPermissionObject = false;
-                            for (var i = 0; i < feature.length; i++) {
-                                if (isPermissionObjectExistForRead && (member.permission.r[params.qstring.app_id].all || (member.permission.r[params.qstring.app_id].allowed && member.permission.r[params.qstring.app_id].allowed[feature[i]]))) {
-                                    isFeatureAllowedInReadPermissionObject = true;
-                                    break;
+                            if (feature) {
+                                for (var i = 0; i < feature.length; i++) {
+                                    if (isPermissionObjectExistForRead && (member.permission.r[params.qstring.app_id].all || (member.permission.r[params.qstring.app_id].allowed && member.permission.r[params.qstring.app_id].allowed[feature[i]]))) {
+                                        isFeatureAllowedInReadPermissionObject = true;
+                                        break;
+                                    }
                                 }
                             }
                         }