Fix booking sync auth bypass
This commit is contained in:
@@ -198,8 +198,7 @@ class bookingsRoute
|
||||
$this->post('/admin/bookings/sync', function () {
|
||||
// Require the user to be logged in
|
||||
global $response;
|
||||
if ($this->fromRequest('auth_key') !== 'earm8BX4MFTgS6JCNQdqW5EzHUutv2Vx')
|
||||
$this->requirePermission('sync_bookings');
|
||||
$this->requirePermission('sync_bookings');
|
||||
// Check if the request was successful
|
||||
$booking = [
|
||||
'id' => $this->fromRequest('id'),
|
||||
@@ -243,7 +242,7 @@ class bookingsRoute
|
||||
);
|
||||
},
|
||||
[
|
||||
'sync_bookings' => 'Sync bookings from the external system NOTE: This permission is only required if the auth_key is not set'
|
||||
'sync_bookings' => 'Sync bookings from the external system'
|
||||
]
|
||||
);
|
||||
|
||||
@@ -530,4 +529,4 @@ class bookingsRoute
|
||||
]
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user