fix: prevent invalid status updates of uploads

src/Security/Voter/UploadVoter.php

@@ -35,7 +35,12 @@ class UploadVoter extends Voter
 
         // Administrative users have full access
         if (true === $this->security->isGranted('ROLE_ADMINISTRATIVE')) {
-            return true;
+            if (true === in_array($attribute, [static::VIEW, static::DELETE, static::DOWNLOAD])) {
+                return true;
+            }
+
+            // Document status may only be updated for selected current status
+            return true === in_array($upload->getStatus(), [Upload::STATUS_NEW, Upload::STATUS_PENDING]);
         }
 
         // Teamers may only access their own documents
@@ -48,4 +53,4 @@ class UploadVoter extends Voter
 
         return false;
     }
-}
+}