Release 2.57 (#5929)

2026-05-21 22:14:10 +02:00
parent f0ce1c7bd6
commit 976d38e8a4
101 changed files with 4226 additions and 1119 deletions
--- a/src/API/TimesheetController.php
+++ b/src/API/TimesheetController.php
@@ -113,6 +113,9 @@ final class TimesheetController extends BaseApiController

            if (!$seeAll) {
                foreach ($userRepository->findByIds($users) as $user) {
+                    if (!$this->isGranted('access_user', $user)) {
+                        throw $this->createAccessDeniedException('Cannot access user: ' . $user->getId());
+                    }
                    $query->addUser($user);
                }
            }