Merge remote-tracking branch 'origin/master'

Author: AngelFQC

src/CoreBundle/Controller/TemplateController.php

@@ -14,6 +14,7 @@
 use Chamilo\CoreBundle\Repository\Node\CourseRepository;
 use Chamilo\CoreBundle\Repository\SystemTemplateRepository;
 use Chamilo\CoreBundle\Repository\TemplatesRepository;
+use Chamilo\CoreBundle\Security\Authorization\Voter\CourseVoter;
 use Chamilo\CoreBundle\Settings\SettingsManager;
 use Chamilo\CourseBundle\Entity\CDocument;
 use Chamilo\CourseBundle\Repository\CDocumentRepository;
@@ -40,6 +41,18 @@ public function createDocumentTemplate(Request $request, EntityManagerInterface
             return $this->json(['error' => 'No image provided.'], Response::HTTP_BAD_REQUEST);
         }
 
+        $document = $entityManager->getRepository(CDocument::class)->find($documentId);
+        if (!$document) {
+            return $this->json(['error' => 'Document not found.'], Response::HTTP_NOT_FOUND);
+        }
+
+        $documentCourse = $document->getFirstResourceLink()?->getCourse();
+        if (!$documentCourse instanceof Course) {
+            throw $this->createAccessDeniedException();
+        }
+
+        $this->denyAccessUnlessGranted(CourseVoter::EDIT, $documentCourse);
+
         $user = $userHelper->getCurrent();
         $course = null;
         if ($cid) {
@@ -62,13 +75,8 @@ public function createDocumentTemplate(Request $request, EntityManagerInterface
         $template->setImage($asset);
         $entityManager->persist($template);
 
-        $document = $entityManager->getRepository(CDocument::class)->find($documentId);
-        if ($document) {
-            $document->setTemplate(true);
-            $entityManager->persist($document);
-        } else {
-            return $this->json(['error' => 'Document not found.'], Response::HTTP_NOT_FOUND);
-        }
+        $document->setTemplate(true);
+        $entityManager->persist($document);
 
         $entityManager->flush();
 
@@ -88,6 +96,18 @@ public function isDocumentTemplate(int $documentId, EntityManagerInterface $enti
     #[Route('/document-templates/{documentId}/delete', methods: ['POST'])]
     public function deleteDocumentTemplate(int $documentId, EntityManagerInterface $entityManager): Response
     {
+        $document = $entityManager->getRepository(CDocument::class)->find($documentId);
+        if (!$document) {
+            return $this->json(['error' => 'Document not found.'], Response::HTTP_NOT_FOUND);
+        }
+
+        $course = $document->getFirstResourceLink()?->getCourse();
+        if (!$course instanceof Course) {
+            throw $this->createAccessDeniedException();
+        }
+
+        $this->denyAccessUnlessGranted(CourseVoter::EDIT, $course);
+
         $template = $entityManager->getRepository(Templates::class)->findOneBy(['refDoc' => $documentId]);
 
         if (!$template) {
@@ -96,13 +116,8 @@ public function deleteDocumentTemplate(int $documentId, EntityManagerInterface $
 
         $entityManager->remove($template);
 
-        $document = $entityManager->getRepository(CDocument::class)->find($documentId);
-        if ($document) {
-            $document->setTemplate(false);
-            $entityManager->persist($document);
-        } else {
-            return $this->json(['error' => 'Document not found.'], Response::HTTP_NOT_FOUND);
-        }
+        $document->setTemplate(false);
+        $entityManager->persist($document);
 
         $entityManager->flush();
 
@@ -126,6 +141,8 @@ public function getAllTemplates(
             throw new NotFoundHttpException('Course not found');
         }
 
+        $this->denyAccessUnlessGranted(CourseVoter::VIEW, $course);
+
         $languageFilterEnabled = $this->isSettingEnabled(
             $settingsManager->getSetting('language.template_activate_language_filter', true)
         );