Skip to content

Conversation

@kingjia90
Copy link
Contributor

@kingjia90 kingjia90 commented Dec 17, 2025

The button is protected on frontend but not on backend from unauthorized access

if (user.isAllowed('web2print_web2print_favourite_output_channels')) {
const navigationItem = {
text: t('web2print_favorite_outputdefinitions'),
iconCls: 'bundle_outputdataconfig_nav_icon',
handler: this.openFavouriteOutputChannel
};
if(e.type === pimcore.events.preMenuBuild){
let menu = e.detail.menu.settings;
menu.items.push(navigationItem);
}
if(e.type === pimcore.events.pimcoreReady){
let menu = pimcore.globalmanager.get('layout_toolbar').settingsMenu;
menu.add(navigationItem);
}
}

@kingjia90 kingjia90 self-assigned this Dec 17, 2025
@kingjia90 kingjia90 added this to the 5.2.2 milestone Dec 17, 2025
Removed permission check from favorite output definitions actions.
@sonarqubecloud
Copy link

@kingjia90 kingjia90 merged commit 7714452 into 5.2 Jan 13, 2026
6 of 8 checks passed
@kingjia90 kingjia90 deleted the permission-fix branch January 13, 2026 08:20
@github-actions github-actions bot locked and limited conversation to collaborators Jan 13, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants