Fix booking sync auth bypass

This commit is contained in:
Jeppe B
2026-06-01 23:01:28 +02:00
parent 4945abfd8e
commit decc571307
+3 -4
View File
@@ -198,8 +198,7 @@ class bookingsRoute
$this->post('/admin/bookings/sync', function () {
// Require the user to be logged in
global $response;
if ($this->fromRequest('auth_key') !== 'earm8BX4MFTgS6JCNQdqW5EzHUutv2Vx')
$this->requirePermission('sync_bookings');
$this->requirePermission('sync_bookings');
// Check if the request was successful
$booking = [
'id' => $this->fromRequest('id'),
@@ -243,7 +242,7 @@ class bookingsRoute
);
},
[
'sync_bookings' => 'Sync bookings from the external system NOTE: This permission is only required if the auth_key is not set'
'sync_bookings' => 'Sync bookings from the external system'
]
);
@@ -530,4 +529,4 @@ class bookingsRoute
]
);
}
}
}