From a8b146d979becc1c3c8fdaaa3a408fba35343696 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <fromme@dreipunktnull.com>
Date: Tue, 22 Apr 2025 10:40:25 +0200
Subject: [PATCH] fix: prevent invalid status updates of uploads

---
 src/Security/Voter/UploadVoter.php | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/Security/Voter/UploadVoter.php b/src/Security/Voter/UploadVoter.php
index 4d2be2c..7653e29 100644
--- a/src/Security/Voter/UploadVoter.php
+++ b/src/Security/Voter/UploadVoter.php
@@ -35,7 +35,12 @@ class UploadVoter extends Voter
 
         // Administrative users have full access
         if (true === $this->security->isGranted('ROLE_ADMINISTRATIVE')) {
-            return true;
+            if (true === in_array($attribute, [static::VIEW, static::DELETE, static::DOWNLOAD])) {
+                return true;
+            }
+
+            // Document status may only be updated for selected current status
+            return true === in_array($upload->getStatus(), [Upload::STATUS_NEW, Upload::STATUS_PENDING]);
         }
 
         // Teamers may only access their own documents
@@ -48,4 +53,4 @@ class UploadVoter extends Voter
 
         return false;
     }
-}
\ No newline at end of file
+}