copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Enforce department access on self-serve status routes

Browse Source
This commit is contained in:
Jeppe B
2026-06-01 22:39:52 +02:00
parent d82c7d88ec
commit 484529660b
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/departmentsRoute.php
+6 -3
View File
@@ -244,6 +244,8 @@ class departmentsRoute
// Return an error
$response->error('Department not found', 404);
}
// Check if the user has access to the department
self::requireDepartmentAccess((string)$department->id);
// Get the department variable
$department_variables = (new department_variables_o())->selectDepartment($department->id);
$enabled = $department_variables->getVariable('selfserve_enabled');
@@ -258,7 +260,8 @@ class departmentsRoute
}
},
[
'view_department_selfserve_enabled' => 'View if department self-serve is enabled'
'view_department_selfserve_enabled' => 'View if department self-serve is enabled',
'department_access_:id' => 'Access the department'
]
);
@@ -282,7 +285,7 @@ class departmentsRoute
$response->error('Department not found', 404);
}
// Check if the user has access to the department
self::requireDepartmentAccess($department);
self::requireDepartmentAccess((string)$department->id);
// Set the department variable
$department_variables = (new department_variables_o())->selectDepartment($department->id);
$enabled = self::getParameter('enabled') === 'true' || self::getParameter('enabled') === true || self::getParameter('enabled') === 1 || self::getParameter('enabled') === '1';
@@ -430,4 +433,4 @@ class departmentsRoute
]
);
}
}
}