blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-22 01:12:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

added 'other lv plan' permission check in api controller

Browse Source
This commit is contained in:
adisposkofh
2026-04-14 16:28:01 +02:00
parent d003bfa7f1
commit cdc279b5da
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/controllers/api/frontend/v1/LvPlan.php
+5
View File
@@ -98,6 +98,11 @@ class LvPlan extends FHCAPI_Controller
$end_date = $this->input->post('end_date', true);
$uid = $this->input->post('uid', true);
// disallow accessing other user's lv plan if missing permission
if ($uid && $uid !== getAuthUID() && !$this->permissionlib->isBerechtigt('basis/other_lv_plan')) {
$this->terminateWithError("Missing permission to view other users' timetables!");
}
// fetching lvplan events
$result = $this->stundenplanlib->getEventsUser($start_date, $end_date, $uid);
$lvplanEvents = $this->getDataOrTerminateWithError($result);