From a45fd217d93248135d173f9b3f5f1d193e95e05b Mon Sep 17 00:00:00 2001 From: cgfhtw Date: Mon, 12 Aug 2024 15:59:23 +0200 Subject: [PATCH] Berechtigungscheck Details --- .../controllers/api/frontend/v1/stv/Student.php | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/application/controllers/api/frontend/v1/stv/Student.php b/application/controllers/api/frontend/v1/stv/Student.php index 6b018ec8b..2f7b02972 100644 --- a/application/controllers/api/frontend/v1/stv/Student.php +++ b/application/controllers/api/frontend/v1/stv/Student.php @@ -33,17 +33,26 @@ class Student extends FHCAPI_Controller */ public function __construct() { - // TODO(chris): permissions parent::__construct([ 'get' => ['admin:r', 'assistenz:r'], - 'save' => ['admin:w', 'assistenz:w'], - 'check' => ['admin:w', 'assistenz:w'], - 'add' => ['admin:w', 'assistenz:w'] + 'save' => ['admin:rw', 'assistenz:rw'], + 'check' => ['admin:rw', 'assistenz:rw'], + 'add' => ['admin:rw', 'assistenz:rw'] // TODO(chris): extra permissions ]); // Load Libraries $this->load->library('VariableLib', ['uid' => getAuthUID()]); + if ($this->router->method == 'get' + || $this->router->method == 'save' + ) { + $prestudent_id = current(array_slice($this->uri->rsegments, 2)); + if ($this->router->method == 'get') + $this->checkPermissionsForPrestudent($prestudent_id, ['admin:r', 'assistenz:r']); + else + $this->checkPermissionsForPrestudent($prestudent_id, ['admin:rw', 'assistenz:rw']); + } + // Load language phrases $this->loadPhrases([ 'ui'