Skip to content

[Bug]: Add permission checks in AdminController actions#108

Merged
kingjia90 merged 3 commits into5.2from
permission-fix
Jan 13, 2026
Merged

[Bug]: Add permission checks in AdminController actions#108
kingjia90 merged 3 commits into5.2from
permission-fix

Conversation

@kingjia90
Copy link
Contributor

@kingjia90 kingjia90 commented Dec 17, 2025

The button is protected on frontend but not on backend from unauthorized access

if (user.isAllowed('web2print_web2print_favourite_output_channels')) {
const navigationItem = {
text: t('web2print_favorite_outputdefinitions'),
iconCls: 'bundle_outputdataconfig_nav_icon',
handler: this.openFavouriteOutputChannel
};
if(e.type === pimcore.events.preMenuBuild){
let menu = e.detail.menu.settings;
menu.items.push(navigationItem);
}
if(e.type === pimcore.events.pimcoreReady){
let menu = pimcore.globalmanager.get('layout_toolbar').settingsMenu;
menu.add(navigationItem);
}
}

@kingjia90 kingjia90 self-assigned this Dec 17, 2025
@kingjia90 kingjia90 added this to the 5.2.2 milestone Dec 17, 2025
Removed permission check from favorite output definitions actions.
@sonarqubecloud
Copy link

@kingjia90 kingjia90 merged commit 7714452 into 5.2 Jan 13, 2026
6 of 8 checks passed
@kingjia90 kingjia90 deleted the permission-fix branch January 13, 2026 08:20
@github-actions github-actions bot locked and limited conversation to collaborators Jan 13, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant