jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

improve export permission checks (#3027)

Browse Source
This commit is contained in:
Kevin Papst
2021-12-17 01:10:49 +01:00
committed by GitHub
parent 04fc954769
commit f7b3f4ed76
4 changed files with 25 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/API/TimesheetController.php
View File

@@ -36,6 +36,7 @@ use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
use Swagger\Annotations as SWG;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Symfony\Component\Validator\Constraints;
use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
@@ -704,6 +705,11 @@ class TimesheetController extends BaseApiController
public function exportAction(Timesheet $id): Response
{
$timesheet = $id;
if ($timesheet->isExported() && !$this->isGranted('edit_exported_timesheet')) {
throw new AccessDeniedHttpException('User cannot edit an exported timesheet');
}
$timesheet->setExported(!$timesheet->isExported());
$this->service->updateTimesheet($timesheet);