From 57e901be27a6d66bd3609d5abb50702c7a4196a2 Mon Sep 17 00:00:00 2001 From: adisposkofh Date: Wed, 6 May 2026 13:41:16 +0200 Subject: [PATCH] other_lv_plan permission on reservations --- application/controllers/api/frontend/v1/LvPlan.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/application/controllers/api/frontend/v1/LvPlan.php b/application/controllers/api/frontend/v1/LvPlan.php index dc87732b9..2e8ac52d4 100644 --- a/application/controllers/api/frontend/v1/LvPlan.php +++ b/application/controllers/api/frontend/v1/LvPlan.php @@ -99,7 +99,7 @@ class LvPlan extends FHCAPI_Controller $end_date = $this->input->post('end_date', true); $uid = $this->input->post('uid', true); - // disallow accessing other user's lv plan if missing permission + // disallow accessing other user's events if missing permission if ($uid && $uid !== getAuthUID() && !$this->permissionlib->isBerechtigt('basis/other_lv_plan')) { $this->terminateWithError("Missing permission to view other users' timetables!"); } @@ -288,6 +288,11 @@ class LvPlan extends FHCAPI_Controller $end_date = $this->input->post('end_date', true); $uid = $this->input->post('uid', true); + // disallow accessing other user's reservierungen if missing permission + if ($uid && $uid !== getAuthUID() && !$this->permissionlib->isBerechtigt('basis/other_lv_plan')) { + $this->terminateWithError("Missing permission to view other users' timetables!"); + } + // get data $this->load->library('StundenplanLib');