Merge branch '1.0'

uvdesk · Jul 19, 2021 · 1591db9 · 1591db9
2 parents 0df1b78 + 9f41305
commit 1591db9
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/Controller/Thread.php b/Controller/Thread.php
@@ -42,6 +42,11 @@ public function saveThread($ticketId, Request $request)
 
         $ticket = $entityManager->getRepository(Ticket::class)->findOneById($ticketId);
 
+        // Proceed only if user has access to the resource
+        if (false == $this->ticketService->isTicketAccessGranted($ticket)) {
+            throw new \Exception('Access Denied', 403);
+        }
+
         if (empty($ticket)) {
             throw new \Exception('Ticket not found', 404);
         } else if ('POST' !== $request->getMethod()) {