From decc571307402439b1e813e5f7236517c262c012 Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 23:01:28 +0200
Subject: [PATCH] Fix booking sync auth bypass

---
 services/nginx/app/routes/bookingsRoute.php | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/services/nginx/app/routes/bookingsRoute.php b/services/nginx/app/routes/bookingsRoute.php
index d4ef953c..ba936bd5 100644
--- a/services/nginx/app/routes/bookingsRoute.php
+++ b/services/nginx/app/routes/bookingsRoute.php
@@ -198,8 +198,7 @@ class bookingsRoute
         $this->post('/admin/bookings/sync', function () {
             // Require the user to be logged in
             global $response;
-            if ($this->fromRequest('auth_key') !== 'earm8BX4MFTgS6JCNQdqW5EzHUutv2Vx')
-                $this->requirePermission('sync_bookings');
+            $this->requirePermission('sync_bookings');
             // Check if the request was successful
             $booking = [
                 'id' => $this->fromRequest('id'),
@@ -243,7 +242,7 @@ class bookingsRoute
             );
         },
             [
-                'sync_bookings' => 'Sync bookings from the external system NOTE: This permission is only required if the auth_key is not set'
+                'sync_bookings' => 'Sync bookings from the external system'
             ]
         );
 
@@ -530,4 +529,4 @@ class bookingsRoute
             ]
         );
     }
-}
\ No newline at end of file
+}