From 5c57dc823ffb77178782e569f6cc2f40e7700a06 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= Date: Wed, 16 Sep 2026 18:03:04 +0200 Subject: [PATCH] fix: add missing access checks --- src/Controller/Administrative/Assignment/CallOffController.php | 2 +- src/Controller/Administrative/Assignment/PublishController.php | 2 ++ .../Administrative/System/Destination/EditController.php | 2 ++ src/Controller/Administrative/System/Faq/IndexController.php | 1 + src/Controller/Common/ApplicationFilterController.php | 1 + src/Controller/Common/AssignmentFilterController.php | 1 + src/Controller/Common/DocumentFilterController.php | 1 + src/Controller/Common/FeedbackFilterController.php | 1 + src/Controller/Common/TeamerFilterController.php | 1 + src/Controller/Common/TimelineFilterController.php | 1 + src/Controller/Manager/IndexController.php | 2 ++ src/Controller/Teamer/ContactController.php | 2 ++ 12 files changed, 16 insertions(+), 1 deletion(-) diff --git a/src/Controller/Administrative/Assignment/CallOffController.php b/src/Controller/Administrative/Assignment/CallOffController.php index 95b0dff..ee84503 100644 --- a/src/Controller/Administrative/Assignment/CallOffController.php +++ b/src/Controller/Administrative/Assignment/CallOffController.php @@ -25,7 +25,7 @@ class CallOffController extends AbstractController } #[Route('/administrative/assignment/call-off/{uuid}', name: 'app_administrative_assignment_call_off')] - #[IsGranted('ROLE_ADMINISTRATIVE')] + #[IsGranted('CALL_OFF', subject: 'assignment')] public function index(Assignment $assignment, Request $request): Response { if (true === $request->isMethod('POST')) { diff --git a/src/Controller/Administrative/Assignment/PublishController.php b/src/Controller/Administrative/Assignment/PublishController.php index 5ce8a44..175834b 100644 --- a/src/Controller/Administrative/Assignment/PublishController.php +++ b/src/Controller/Administrative/Assignment/PublishController.php @@ -11,6 +11,7 @@ use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Routing\Attribute\Route; +use Symfony\Component\Security\Http\Attribute\IsGranted; class PublishController extends AbstractController { @@ -23,6 +24,7 @@ class PublishController extends AbstractController } #[Route('/administrative/assignment/publish/{uuid}', name: 'app_administrative_assignment_publish')] + #[IsGranted('PUBLISH', subject: 'assignment')] public function index(Assignment $assignment, Request $request): Response { $returnUrl = $this->getReturnUrl($request, 'app_administrative_assignment_index'); diff --git a/src/Controller/Administrative/System/Destination/EditController.php b/src/Controller/Administrative/System/Destination/EditController.php index 2073679..da07edd 100644 --- a/src/Controller/Administrative/System/Destination/EditController.php +++ b/src/Controller/Administrative/System/Destination/EditController.php @@ -13,6 +13,7 @@ use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Routing\Attribute\Route; +use Symfony\Component\Security\Http\Attribute\IsGranted; class EditController extends AbstractController { @@ -27,6 +28,7 @@ class EditController extends AbstractController } #[Route('/administrative/destination/edit/{id}', name: 'app_administrative_system_destination_edit')] + #[IsGranted('ROLE_ADMINISTRATIVE')] public function index(Destination $destination, Request $request): Response { $destinationDto = DestinationDto::fromEntity($destination); diff --git a/src/Controller/Administrative/System/Faq/IndexController.php b/src/Controller/Administrative/System/Faq/IndexController.php index 7777434..0019556 100644 --- a/src/Controller/Administrative/System/Faq/IndexController.php +++ b/src/Controller/Administrative/System/Faq/IndexController.php @@ -32,6 +32,7 @@ class IndexController extends AbstractController } #[Route('/administrative/system/faq/sort', name: 'app_administrative_system_faq_sort', methods: ['POST'])] + #[IsGranted('ROLE_ADMINISTRATIVE')] public function sort(Request $request): JsonResponse { $data = json_decode($request->getContent(), true); diff --git a/src/Controller/Common/ApplicationFilterController.php b/src/Controller/Common/ApplicationFilterController.php index ac16b08..4b8f320 100644 --- a/src/Controller/Common/ApplicationFilterController.php +++ b/src/Controller/Common/ApplicationFilterController.php @@ -55,6 +55,7 @@ class ApplicationFilterController extends AbstractController } #[Route('/common/application/filter/reset', name: 'app_common_application_filter_reset')] + #[IsGranted('ROLE_USER')] public function reset(Request $request): Response { $this->filterHandler->resetFilterSettings(); diff --git a/src/Controller/Common/AssignmentFilterController.php b/src/Controller/Common/AssignmentFilterController.php index d3feb05..4fad106 100644 --- a/src/Controller/Common/AssignmentFilterController.php +++ b/src/Controller/Common/AssignmentFilterController.php @@ -53,6 +53,7 @@ class AssignmentFilterController extends AbstractController } #[Route('/common/assignment/filter/reset', name: 'app_common_assignment_filter_reset')] + #[IsGranted('ROLE_USER')] public function reset(Request $request): Response { $this->filterHandler->resetFilterSettings(); diff --git a/src/Controller/Common/DocumentFilterController.php b/src/Controller/Common/DocumentFilterController.php index 143ca3f..8c240cd 100644 --- a/src/Controller/Common/DocumentFilterController.php +++ b/src/Controller/Common/DocumentFilterController.php @@ -47,6 +47,7 @@ class DocumentFilterController extends AbstractController } #[Route('/common/document/filter/reset', name: 'app_common_document_filter_reset')] + #[IsGranted('ROLE_USER')] public function reset(Request $request): Response { $this->filterHandler->resetFilterSettings(); diff --git a/src/Controller/Common/FeedbackFilterController.php b/src/Controller/Common/FeedbackFilterController.php index e767a5e..658401b 100644 --- a/src/Controller/Common/FeedbackFilterController.php +++ b/src/Controller/Common/FeedbackFilterController.php @@ -39,6 +39,7 @@ class FeedbackFilterController extends AbstractController } #[Route('/common/feedback/filter/reset', name: 'app_common_feedback_filter_reset')] + #[IsGranted('ROLE_USER')] public function reset(Request $request): Response { $this->filterHandler->resetFilterSettings(); diff --git a/src/Controller/Common/TeamerFilterController.php b/src/Controller/Common/TeamerFilterController.php index b66c9ff..eb7c3c1 100644 --- a/src/Controller/Common/TeamerFilterController.php +++ b/src/Controller/Common/TeamerFilterController.php @@ -42,6 +42,7 @@ class TeamerFilterController extends AbstractController } #[Route('/common/teamer/filter/reset', name: 'app_common_teamer_filter_reset')] + #[IsGranted('ROLE_USER')] public function reset(Request $request): Response { $this->filterHandler->resetFilterSettings(); diff --git a/src/Controller/Common/TimelineFilterController.php b/src/Controller/Common/TimelineFilterController.php index 021deae..e34d271 100644 --- a/src/Controller/Common/TimelineFilterController.php +++ b/src/Controller/Common/TimelineFilterController.php @@ -52,6 +52,7 @@ class TimelineFilterController extends AbstractController } #[Route('/common/timeline/filter/reset', name: 'app_common_timeline_filter_reset')] + #[IsGranted('ROLE_USER')] public function reset(Request $request): Response { $this->filterHandler->resetFilterSettings(); diff --git a/src/Controller/Manager/IndexController.php b/src/Controller/Manager/IndexController.php index 8123f20..cf882cc 100644 --- a/src/Controller/Manager/IndexController.php +++ b/src/Controller/Manager/IndexController.php @@ -8,6 +8,7 @@ use App\Repository\UploadRepository; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Routing\Attribute\Route; +use Symfony\Component\Security\Http\Attribute\IsGranted; class IndexController extends AbstractController { @@ -18,6 +19,7 @@ class IndexController extends AbstractController } #[Route('/management', name: 'app_manager_index')] + #[IsGranted('ROLE_MANAGER')] public function index(): Response { $dispositions = $this->dispositionRepository->getNew(); diff --git a/src/Controller/Teamer/ContactController.php b/src/Controller/Teamer/ContactController.php index cb9fd67..25d5c11 100644 --- a/src/Controller/Teamer/ContactController.php +++ b/src/Controller/Teamer/ContactController.php @@ -7,6 +7,7 @@ use App\Repository\ContactRepository; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Component\HttpFoundation\Response; use Symfony\Component\Routing\Attribute\Route; +use Symfony\Component\Security\Http\Attribute\IsGranted; class ContactController extends AbstractController { @@ -15,6 +16,7 @@ class ContactController extends AbstractController } #[Route('/teamer/contact', name: 'app_teamer_contact')] + #[IsGranted('ROLE_USER')] public function index(): Response { $allContacts = $this