Security: require course view permission to list course document templates

AngelFQC · web-flow · commit 0783587143ae · 2026-06-24T16:20:45.000-05:00
Refs GHSA-9r7v-p62p-h9gc
diff --git a/src/CoreBundle/Controller/TemplateController.php b/src/CoreBundle/Controller/TemplateController.php
@@ -134,6 +134,8 @@ public function getAllTemplates(
             throw new NotFoundHttpException('Course not found');
         }
 
+        $this->denyAccessUnlessGranted(CourseVoter::VIEW, $course);
+
         $languageFilterEnabled = $this->isSettingEnabled(
             $settingsManager->getSetting('language.template_activate_language_filter', true)
         );

Original file line number	Diff line number	Diff line change
`@@ -134,6 +134,8 @@ public function getAllTemplates(`
`134`	`134`	`throw new NotFoundHttpException('Course not found');`
`135`	`135`	`}`
`136`	`136`
	`137`	`+ $this->denyAccessUnlessGranted(CourseVoter::VIEW, $course);`
	`138`	`+`
`137`	`139`	`$languageFilterEnabled = $this->isSettingEnabled(`
`138`	`140`	`$settingsManager->getSetting('language.template_activate_language_filter', true)`
`139`	`141`	`);`