diff --git a/application/controllers/api/frontend/v1/LvPlan.php b/application/controllers/api/frontend/v1/LvPlan.php index dc87732b9..2e8ac52d4 100644 --- a/application/controllers/api/frontend/v1/LvPlan.php +++ b/application/controllers/api/frontend/v1/LvPlan.php @@ -99,7 +99,7 @@ class LvPlan extends FHCAPI_Controller $end_date = $this->input->post('end_date', true); $uid = $this->input->post('uid', true); - // disallow accessing other user's lv plan if missing permission + // disallow accessing other user's events if missing permission if ($uid && $uid !== getAuthUID() && !$this->permissionlib->isBerechtigt('basis/other_lv_plan')) { $this->terminateWithError("Missing permission to view other users' timetables!"); } @@ -288,6 +288,11 @@ class LvPlan extends FHCAPI_Controller $end_date = $this->input->post('end_date', true); $uid = $this->input->post('uid', true); + // disallow accessing other user's reservierungen if missing permission + if ($uid && $uid !== getAuthUID() && !$this->permissionlib->isBerechtigt('basis/other_lv_plan')) { + $this->terminateWithError("Missing permission to view other users' timetables!"); + } + // get data $this->load->library('StundenplanLib');