Security: require course view permission to list course document templates

Author: AngelFQC

src/CoreBundle/Controller/TemplateController.php

@@ -14,6 +14,7 @@
 use Chamilo\CoreBundle\Repository\Node\CourseRepository;
 use Chamilo\CoreBundle\Repository\SystemTemplateRepository;
 use Chamilo\CoreBundle\Repository\TemplatesRepository;
+use Chamilo\CoreBundle\Security\Authorization\Voter\CourseVoter;
 use Chamilo\CoreBundle\Settings\SettingsManager;
 use Chamilo\CourseBundle\Entity\CDocument;
 use Chamilo\CourseBundle\Repository\CDocumentRepository;
@@ -126,6 +127,8 @@ public function getAllTemplates(
             throw new NotFoundHttpException('Course not found');
         }
 
+        $this->denyAccessUnlessGranted(CourseVoter::VIEW, $course);
+
         $languageFilterEnabled = $this->isSettingEnabled(
             $settingsManager->getSetting('language.template_activate_language_filter', true)
         );