From fe22585a411cb92f1d3e3a4b2ed8ac4770dc85b8 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Mon, 25 May 2026 17:36:05 -0500
Subject: [PATCH 01/38] Introduce `CourseContextRoleListener` to dynamically
 assign contextual course roles

---
 .../CourseContextRoleListener.php             | 111 ++++++++++++++++
 src/CoreBundle/Resources/config/listeners.yml |   7 +
 .../Security/CourseAccessResolver.php         | 120 ++++++++++++++++++
 3 files changed, 238 insertions(+)
 create mode 100644 src/CoreBundle/EventListener/CourseContextRoleListener.php
 create mode 100644 src/CoreBundle/Security/CourseAccessResolver.php

diff --git a/src/CoreBundle/EventListener/CourseContextRoleListener.php b/src/CoreBundle/EventListener/CourseContextRoleListener.php
new file mode 100644
index 00000000000..860bf4cc9cb
--- /dev/null
+++ b/src/CoreBundle/EventListener/CourseContextRoleListener.php
@@ -0,0 +1,111 @@
+<?php
+
+/* For licensing terms, see /license.txt */
+
+declare(strict_types=1);
+
+namespace Chamilo\CoreBundle\EventListener;
+
+use Chamilo\CoreBundle\Entity\Course;
+use Chamilo\CoreBundle\Entity\Session;
+use Chamilo\CoreBundle\Entity\User;
+use Chamilo\CoreBundle\Security\CourseAccessResolver;
+use Chamilo\CourseBundle\Entity\CGroup;
+use Symfony\Component\HttpKernel\Event\RequestEvent;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
+use Symfony\Component\Security\Http\Authenticator\Token\PostAuthenticationToken;
+
+/**
+ * Publishes the contextual ROLE_CURRENT_COURSE_* roles for the authenticated
+ * user once CidReqListener has resolved the course/session/group context.
+ *
+ * The roles are exposed in two places so that every consumer keeps working:
+ *   - User::$temporaryRoles, so ResourceNodeVoter::hasContextRole() and any
+ *     code reading $user->getRoles() continues to see them.
+ *   - The security token's roleNames, so expressions such as
+ *     `security: "is_granted('ROLE_CURRENT_COURSE_STUDENT')"` on
+ *     API Platform operations resolve correctly (AbstractToken::getRoleNames()
+ *     freezes the role list at token-creation time).
+ *
+ * Must run with a kernel.request priority lower than CidReqListener (priority 6)
+ * so the course/session/group is already in the session by the time we look it up.
+ */
+final class CourseContextRoleListener
+{
+    public function __construct(
+        private readonly TokenStorageInterface $tokenStorage,
+        private readonly CourseAccessResolver $resolver,
+    ) {}
+
+    public function onKernelRequest(RequestEvent $event): void
+    {
+        if (!$event->isMainRequest()) {
+            return;
+        }
+
+        $request = $event->getRequest();
+        if (!$request->hasSession()) {
+            return;
+        }
+
+        $token = $this->tokenStorage->getToken();
+        if (null === $token) {
+            return;
+        }
+
+        $user = $token->getUser();
+        if (!$user instanceof User) {
+            return;
+        }
+
+        $sessionHandler = $request->getSession();
+        $course = $sessionHandler->get('course');
+        $courseSession = $sessionHandler->get('session');
+        $group = $sessionHandler->get('group');
+
+        $contextRoles = [];
+        if ($course instanceof Course) {
+            $contextRoles = $this->resolver->resolveCourseRoles(
+                $user,
+                $course,
+                $courseSession instanceof Session ? $courseSession : null,
+            );
+
+            if ($group instanceof CGroup) {
+                $contextRoles = array_merge(
+                    $contextRoles,
+                    $this->resolver->resolveGroupRoles($user, $course, $group),
+                );
+            }
+        }
+
+        $contextRoles = array_values(array_unique($contextRoles));
+
+        $existingRoleNames = $token->getRoleNames();
+        $hasStaleContextRoles = [] !== array_intersect($existingRoleNames, User::CONTEXT_ROLES);
+
+        // Nothing to sync: no current context and no stale roles to strip.
+        if ([] === $contextRoles && !$hasStaleContextRoles) {
+            return;
+        }
+
+        // Mirror the context roles into the User's temporary roles so that any
+        // legacy code reading $user->getRoles() observes the same state.
+        foreach ($contextRoles as $role) {
+            $user->addTemporaryRole($role);
+        }
+
+        $persistedRoleNames = array_values(array_diff($existingRoleNames, User::CONTEXT_ROLES));
+        $desiredRoleNames = array_values(array_unique(array_merge($persistedRoleNames, $contextRoles)));
+
+        $firewallName = method_exists($token, 'getFirewallName')
+            ? (string) $token->getFirewallName()
+            : 'main';
+
+        if ('' === $firewallName) {
+            $firewallName = 'main';
+        }
+
+        $this->tokenStorage->setToken(new PostAuthenticationToken($user, $firewallName, $desiredRoleNames));
+    }
+}
diff --git a/src/CoreBundle/Resources/config/listeners.yml b/src/CoreBundle/Resources/config/listeners.yml
index fe32cb20c50..a0391441e00 100644
--- a/src/CoreBundle/Resources/config/listeners.yml
+++ b/src/CoreBundle/Resources/config/listeners.yml
@@ -15,6 +15,13 @@ services:
             - {name: kernel.event_listener, event: kernel.request, method: onKernelRequest, priority: 6}
             - {name: kernel.event_listener, event: kernel.controller, method: onKernelController}
 
+    # Publishes ROLE_CURRENT_COURSE_* on the token after CidReqListener (priority 6)
+    # has resolved the cid/sid/gid context. Must run with a lower priority so the
+    # course, session and group are already available in the request session.
+    Chamilo\CoreBundle\EventListener\CourseContextRoleListener:
+        tags:
+            - {name: kernel.event_listener, event: kernel.request, method: onKernelRequest, priority: 5}
+
     # Sets the user access in a course listener
     Chamilo\CoreBundle\EventListener\CourseAccessListener:
       tags:
diff --git a/src/CoreBundle/Security/CourseAccessResolver.php b/src/CoreBundle/Security/CourseAccessResolver.php
new file mode 100644
index 00000000000..29b111f7beb
--- /dev/null
+++ b/src/CoreBundle/Security/CourseAccessResolver.php
@@ -0,0 +1,120 @@
+<?php
+
+/* For licensing terms, see /license.txt */
+
+declare(strict_types=1);
+
+namespace Chamilo\CoreBundle\Security;
+
+use Chamilo\CoreBundle\Entity\Course;
+use Chamilo\CoreBundle\Entity\Session;
+use Chamilo\CoreBundle\Entity\User;
+use Chamilo\CoreBundle\Security\Authorization\Voter\ResourceNodeVoter;
+use Chamilo\CoreBundle\Settings\SettingsManager;
+use Chamilo\CourseBundle\Entity\CGroup;
+
+use const FILTER_VALIDATE_BOOLEAN;
+
+/**
+ * Resolves the contextual ROLE_CURRENT_COURSE_* roles a User has within a given
+ * Course, optional course Session, and optional CGroup.
+ *
+ * Pure service: never mutates the User, the security token, or persists anything.
+ * It mirrors the relationship logic embedded in CourseVoter / SessionVoter /
+ * GroupVoter so that role assignment can happen in a dedicated request listener
+ * instead of as a side effect inside Voters.
+ */
+final class CourseAccessResolver
+{
+    public function __construct(
+        private readonly SettingsManager $settingsManager,
+    ) {}
+
+    /**
+     * @return array<int, string> ROLE_CURRENT_COURSE_* role names the user holds in the given course/session
+     */
+    public function resolveCourseRoles(User $user, Course $course, ?Session $session = null): array
+    {
+        if ($course->isHidden()) {
+            return [];
+        }
+
+        if ($course->isPublic()) {
+            return $this->courseRolesForAccessibleCourse($user, $course);
+        }
+
+        if (Course::OPEN_PLATFORM === $course->getVisibility()
+            && false === $this->isOpenCourseAccessBlockedForRegisteredUsers()
+        ) {
+            return $this->courseRolesForAccessibleCourse($user, $course);
+        }
+
+        if (null !== $session) {
+            if ($session->hasUserAsGeneralCoach($user)
+                || $session->hasCourseCoachInCourse($user, $course)
+            ) {
+                return [ResourceNodeVoter::ROLE_CURRENT_COURSE_SESSION_TEACHER];
+            }
+
+            if ($session->hasUserInCourse($user, $course, Session::STUDENT)) {
+                return [ResourceNodeVoter::ROLE_CURRENT_COURSE_SESSION_STUDENT];
+            }
+        }
+
+        if (Course::REGISTERED === $course->getVisibility()
+            && $course->hasSubscriptionByUser($user)
+        ) {
+            return $this->courseRolesForAccessibleCourse($user, $course);
+        }
+
+        return [];
+    }
+
+    /**
+     * @return array<int, string> ROLE_CURRENT_COURSE_GROUP_* role names the user holds in the given group
+     */
+    public function resolveGroupRoles(User $user, Course $course, CGroup $group): array
+    {
+        if ($course->isHidden()) {
+            return [];
+        }
+
+        if (Course::REGISTERED === $course->getVisibility()
+            && false === $course->hasSubscriptionByUser($user)
+        ) {
+            return [];
+        }
+
+        if ($course->hasUserAsTeacher($user) || $group->hasTutor($user)) {
+            return [ResourceNodeVoter::ROLE_CURRENT_COURSE_GROUP_TEACHER];
+        }
+
+        if ($group->hasMember($user)) {
+            return [ResourceNodeVoter::ROLE_CURRENT_COURSE_GROUP_STUDENT];
+        }
+
+        return [];
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function courseRolesForAccessibleCourse(User $user, Course $course): array
+    {
+        $roles = [ResourceNodeVoter::ROLE_CURRENT_COURSE_STUDENT];
+
+        if ($course->hasUserAsTeacher($user)) {
+            $roles[] = ResourceNodeVoter::ROLE_CURRENT_COURSE_TEACHER;
+        }
+
+        return $roles;
+    }
+
+    private function isOpenCourseAccessBlockedForRegisteredUsers(): bool
+    {
+        return filter_var(
+            $this->settingsManager->getSetting('course.block_registered_users_access_to_open_course_contents', true),
+            FILTER_VALIDATE_BOOLEAN,
+        );
+    }
+}

From 3fb900c0be03a85da24e843c92adc93ac93d7504 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Mon, 25 May 2026 17:53:59 -0500
Subject: [PATCH 02/38] Refactor `Voter` classes to remove dynamic role
 assignments from users and streamline access checks

---
 .../Authorization/Voter/CourseVoter.php       | 123 ++++--------------
 .../Authorization/Voter/GroupVoter.php        |  10 --
 .../Authorization/Voter/SessionVoter.php      |  27 +---
 3 files changed, 30 insertions(+), 130 deletions(-)

diff --git a/src/CoreBundle/Security/Authorization/Voter/CourseVoter.php b/src/CoreBundle/Security/Authorization/Voter/CourseVoter.php
index f883801ea19..7b54623e324 100644
--- a/src/CoreBundle/Security/Authorization/Voter/CourseVoter.php
+++ b/src/CoreBundle/Security/Authorization/Voter/CourseVoter.php
@@ -64,7 +64,7 @@ protected function supports(string $attribute, $subject): bool
 
     protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
     {
-        $tokenUser = $token->getUser();
+        $user = $token->getUser();
 
         // Admins have access to everything.
         if ($this->security->isGranted('ROLE_ADMIN')) {
@@ -76,116 +76,73 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
         $request = $this->requestStack->getCurrentRequest();
 
         $sessionId = $request?->query?->get('sid');
-        $sessionRepository = $this->entityManager->getRepository(Session::class);
         $session = null;
 
         if (!empty($sessionId)) {
             /** @var Session|null $session */
-            $session = $sessionRepository->find($sessionId);
+            $session = $this->entityManager->getRepository(Session::class)->find($sessionId);
         }
 
         switch ($attribute) {
             case self::VIEW:
-                // Course is hidden then is not visible for nobody expect admins.
+                // Course is hidden, so it is not visible for anyone except admins.
                 if ($course->isHidden()) {
                     return false;
                 }
 
                 // Course::OPEN_WORLD
                 if ($course->isPublic()) {
-                    if ($tokenUser instanceof User) {
-                        $user = $this->getTokenSafeUser($token, $tokenUser);
-                        if ($this->isStudent($user, $course, $session)) {
-                            if ($this->isCourseLockedForUser($user, $course, $session?->getId() ?? 0)) {
-                                throw new NotAllowedException($this->translator->trans('This course is locked. You must complete the prerequisite(s) first.'), 'warning', 403);
-                            }
-                        }
-
-                        $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_STUDENT);
-                        if ($course->hasUserAsTeacher($user)) {
-                            $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_TEACHER);
-                        }
-
-                        $token->setUser($user);
+                    if ($user instanceof User
+                        && $this->isStudent($user, $course, $session)
+                        && $this->isCourseLockedForUser($user, $course, $session?->getId() ?? 0)
+                    ) {
+                        throw new NotAllowedException($this->translator->trans('This course is locked. You must complete the prerequisite(s) first.'), 'warning', 403);
                     }
 
                     return true;
                 }
 
-                // User should be instance of UserInterface.
-                if (!$tokenUser instanceof UserInterface) {
+                if (!$user instanceof UserInterface) {
                     return false;
                 }
 
                 // Course::OPEN_PLATFORM
-                if (Course::OPEN_PLATFORM === $course->getVisibility()) {
-                    if (false === $this->isOpenCourseAccessBlockedForRegisteredUsers()) {
-                        if ($tokenUser instanceof User) {
-                            $user = $this->getTokenSafeUser($token, $tokenUser);
-                            if ($this->isStudent($user, $course, $session)) {
-                                if ($this->isCourseLockedForUser($user, $course, $session?->getId() ?? 0)) {
-                                    throw new NotAllowedException($this->translator->trans('This course is locked. You must complete the prerequisite(s) first.'), 'warning', 403);
-                                }
-                            }
-
-                            $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_STUDENT);
-
-                            if ($course->hasUserAsTeacher($user)) {
-                                $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_TEACHER);
-                            }
-
-                            $token->setUser($user);
-                        }
-
-                        return true;
+                if (Course::OPEN_PLATFORM === $course->getVisibility()
+                    && false === $this->isOpenCourseAccessBlockedForRegisteredUsers()
+                ) {
+                    if ($user instanceof User
+                        && $this->isStudent($user, $course, $session)
+                        && $this->isCourseLockedForUser($user, $course, $session?->getId() ?? 0)
+                    ) {
+                        throw new NotAllowedException($this->translator->trans('This course is locked. You must complete the prerequisite(s) first.'), 'warning', 403);
                     }
-                }
-
-                // Validation in session
-                if ($session && $tokenUser instanceof User) {
-                    $user = $this->getTokenSafeUser($token, $tokenUser);
-
-                    $userIsGeneralCoach = $session->hasUserAsGeneralCoach($user);
-                    $userIsCourseCoach = $session->hasCourseCoachInCourse($user, $course);
-                    $userIsStudent = $session->hasUserInCourse($user, $course, Session::STUDENT);
 
-                    if ($userIsGeneralCoach || $userIsCourseCoach) {
-                        $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_SESSION_TEACHER);
-
-                        $token->setUser($user);
+                    return true;
+                }
 
+                // Session-based access.
+                if (null !== $session && $user instanceof User) {
+                    if ($session->hasUserAsGeneralCoach($user)
+                        || $session->hasCourseCoachInCourse($user, $course)
+                    ) {
                         return true;
                     }
 
-                    if ($userIsStudent) {
-                        $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_SESSION_STUDENT);
-
+                    if ($session->hasUserInCourse($user, $course, Session::STUDENT)) {
                         if ($this->isCourseLockedForUser($user, $course, $session->getId())) {
                             throw new NotAllowedException($this->translator->trans('This course is locked. You must complete the prerequisite(s) first.'), 'warning', 403);
                         }
 
-                        $token->setUser($user);
-
                         return true;
                     }
                 }
 
                 // Course::REGISTERED
-                if ($tokenUser instanceof User && $course->hasSubscriptionByUser($tokenUser)) {
-                    $user = $this->getTokenSafeUser($token, $tokenUser);
-
-                    $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_STUDENT);
-
-                    if ($course->hasUserAsTeacher($user)) {
-                        $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_TEACHER);
-                    }
-
+                if ($user instanceof User && $course->hasSubscriptionByUser($user)) {
                     if ($this->isCourseLockedForUser($user, $course)) {
                         throw new NotAllowedException($this->translator->trans('This course is locked. You must complete the prerequisite(s) first.'), 'warning', 403);
                     }
 
-                    $token->setUser($user);
-
                     return true;
                 }
 
@@ -193,38 +150,12 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
 
             case self::EDIT:
             case self::DELETE:
-                if ($tokenUser instanceof User && $course->hasUserAsTeacher($tokenUser)) {
-                    $user = $this->getTokenSafeUser($token, $tokenUser);
-
-                    $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_TEACHER);
-
-                    $token->setUser($user);
-
-                    return true;
-                }
-
-                return false;
+                return $user instanceof User && $course->hasUserAsTeacher($user);
         }
 
         return false;
     }
 
-    /**
-     * Returns a "token-safe" User instance to add context roles without persisting them to DB.
-     *
-     * If the User is managed by Doctrine, we clone it, add roles to the clone,
-     * and store the clone in the token.
-     */
-    private function getTokenSafeUser(TokenInterface $token, User $user): User
-    {
-        if ($this->entityManager->contains($user)) {
-            $user = clone $user;
-            $token->setUser($user);
-        }
-
-        return $user;
-    }
-
     /**
      * Checks whether registered users must be subscribed before accessing
      * OPEN_PLATFORM course contents.
diff --git a/src/CoreBundle/Security/Authorization/Voter/GroupVoter.php b/src/CoreBundle/Security/Authorization/Voter/GroupVoter.php
index 2df552e8a23..9e5c1984c39 100644
--- a/src/CoreBundle/Security/Authorization/Voter/GroupVoter.php
+++ b/src/CoreBundle/Security/Authorization/Voter/GroupVoter.php
@@ -93,8 +93,6 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
         }
 
         if ($course->hasUserAsTeacher($user)) {
-            $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_GROUP_TEACHER);
-
             return true;
         }
 
@@ -105,8 +103,6 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
         switch ($attribute) {
             case self::VIEW:
                 if ($isTutor) {
-                    $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_GROUP_TEACHER);
-
                     return true;
                 }
 
@@ -116,10 +112,6 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
 
                 $userIsInGroup = $group->hasMember($user);
 
-                if ($userIsInGroup) {
-                    $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_GROUP_STUDENT);
-                }
-
                 $requestUri = '';
                 // Check if user has access in legacy tool.
                 $request = $this->requestStack->getCurrentRequest();
@@ -177,8 +169,6 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
             case self::EDIT:
             case self::DELETE:
                 if ($isTutor) {
-                    $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_GROUP_TEACHER);
-
                     return true;
                 }
 
diff --git a/src/CoreBundle/Security/Authorization/Voter/SessionVoter.php b/src/CoreBundle/Security/Authorization/Voter/SessionVoter.php
index af9a072d52c..37d1725d137 100644
--- a/src/CoreBundle/Security/Authorization/Voter/SessionVoter.php
+++ b/src/CoreBundle/Security/Authorization/Voter/SessionVoter.php
@@ -98,35 +98,14 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
                     return false;
                 }
 
-                if ($userIsGeneralCoach || $userIsCourseCoach) {
-                    $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_SESSION_TEACHER);
-                } elseif ($userIsStudent) { // Student access.
-                    $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_SESSION_STUDENT);
-                }
-
-                if (
-                    ($userIsGeneralCoach || $userIsCourseCoach || $userIsStudent)
-                    && Session::INVISIBLE != $visibilityForUser
-                ) {
-                    return true;
-                }
-
-                return false;
+                return ($userIsGeneralCoach || $userIsCourseCoach || $userIsStudent)
+                    && Session::INVISIBLE != $visibilityForUser;
 
             case self::EDIT:
             case self::DELETE:
-                $canEdit = $this->canEditSession($user, $session, false);
-
-                if ($canEdit) {
-                    $user->addRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_SESSION_TEACHER);
-
-                    return true;
-                }
-
-                return false;
+                return $this->canEditSession($user, $session, false);
         }
 
-        // User don't have access to the session
         return false;
     }
 

From d1913ee0d8e7c62f816a9b7f597b5c2f30b48e10 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Mon, 25 May 2026 18:31:30 -0500
Subject: [PATCH 03/38] Security: Restrict document access to course-specific
 roles (`ROLE_CURRENT_COURSE_STUDENT` and
 `ROLE_CURRENT_COURSE_SESSION_STUDENT`)

---
 src/CourseBundle/Entity/CDocument.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/CourseBundle/Entity/CDocument.php b/src/CourseBundle/Entity/CDocument.php
index f966261d176..093beda9424 100644
--- a/src/CourseBundle/Entity/CDocument.php
+++ b/src/CourseBundle/Entity/CDocument.php
@@ -210,7 +210,7 @@
                     ]),
                 ),
             ),
-            security: "is_granted('ROLE_USER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
         ),
         new Post(
             uriTemplate: '/documents/download-all',
@@ -245,7 +245,7 @@
                     ]),
                 ),
             ),
-            security: "is_granted('ROLE_USER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
             deserialize: false
         ),
         new GetCollection(
@@ -274,7 +274,7 @@
                     ),
                 ],
             ),
-            security: "is_granted('ROLE_USER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
             provider: DocumentCollectionStateProvider::class,
         ),
         new Get(

From 35dda3fdb253d4230208b9be61fffed3c410b8ff Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Mon, 25 May 2026 19:09:39 -0500
Subject: [PATCH 04/38] Security: Add regression tests for CDocument API to
 prevent unauthorized document access

---
 tests/CourseBundle/Api/CDocumentApiTest.php | 536 ++++++++++++++++++++
 1 file changed, 536 insertions(+)
 create mode 100644 tests/CourseBundle/Api/CDocumentApiTest.php

diff --git a/tests/CourseBundle/Api/CDocumentApiTest.php b/tests/CourseBundle/Api/CDocumentApiTest.php
new file mode 100644
index 00000000000..70463e04cc8
--- /dev/null
+++ b/tests/CourseBundle/Api/CDocumentApiTest.php
@@ -0,0 +1,536 @@
+<?php
+
+declare(strict_types=1);
+
+/* For licensing terms, see /license.txt */
+
+namespace Chamilo\Tests\CourseBundle\Api;
+
+use Chamilo\CoreBundle\Entity\Course;
+use Chamilo\CoreBundle\Entity\ResourceLink;
+use Chamilo\CoreBundle\Entity\User;
+use Chamilo\CoreBundle\Repository\Node\CourseRepository;
+use Chamilo\CourseBundle\Entity\CDocument;
+use Chamilo\CourseBundle\Repository\CDocumentRepository;
+use Chamilo\Tests\AbstractApiTest;
+use Chamilo\Tests\ChamiloTestTrait;
+
+use const JSON_THROW_ON_ERROR;
+
+/**
+ * Regression tests for the documents-listing IDOR / draft-leak advisory.
+ *
+ * The advisory reported that authenticated users outside the course scope could
+ * enumerate documents (including DRAFT/unpublished ones) of any course via:
+ *
+ *     GET /api/documents?cid={courseId}
+ *
+ * The endpoint declares a custom provider (DocumentCollectionStateProvider) and
+ * therefore bypasses CDocumentExtension — losing the course-link visibility
+ * filter that excludes drafts for non-teachers. The provider also lacks an
+ * is_granted('VIEW', $course) check, so foreign users obtain document metadata
+ * from any course (including REGISTERED / private ones).
+ *
+ * These tests assert the expected post-fix behaviour:
+ *  - foreign authenticated user listing a private course's documents → 403
+ *  - enrolled student → 200 with PUBLISHED documents only, never DRAFT
+ *  - enrolled teacher → 200, may see DRAFT documents
+ *  - admin → 200, sees DRAFT documents
+ */
+final class CDocumentApiTest extends AbstractApiTest
+{
+    use ChamiloTestTrait;
+
+    /**
+     * Builds a private (REGISTERED) course owned by a teacher, subscribes a
+     * student and leaves an attacker user out of the course. Adds two documents
+     * to the course's root: one PUBLISHED and one DRAFT.
+     *
+     * @return array{
+     *     course: Course,
+     *     teacher: User,
+     *     student: User,
+     *     attacker: User,
+     *     publishedDoc: CDocument,
+     *     draftDoc: CDocument
+     * }
+     */
+    private function bootstrapDocumentScenario(string $suffix): array
+    {
+        /** @var CourseRepository $courseRepo */
+        $courseRepo = self::getContainer()->get(CourseRepository::class);
+
+        /** @var CDocumentRepository $documentRepo */
+        $documentRepo = self::getContainer()->get(CDocumentRepository::class);
+
+        $course = $this->createCourse('Doc Sec Course '.$suffix);
+        $course->setVisibility(Course::REGISTERED);
+
+        $teacher = $this->createUser('doc_sec_teacher_'.$suffix);
+        $student = $this->createUser('doc_sec_student_'.$suffix);
+        $attacker = $this->createUser('doc_sec_attacker_'.$suffix);
+
+        $course->addUserAsTeacher($teacher);
+        $course->addUserAsStudent($student);
+        $courseRepo->update($course);
+
+        $admin = $this->getAdmin();
+
+        $publishedDoc = (new CDocument())
+            ->setFiletype('file')
+            ->setTitle('published-doc-'.$suffix)
+            ->setTemplate(false)
+            ->setReadonly(false)
+            ->setParent($course)
+            ->setCreator($admin)
+            ->addCourseLink($course, null, null, ResourceLink::VISIBILITY_PUBLISHED)
+        ;
+        $documentRepo->create($publishedDoc);
+
+        $draftDoc = (new CDocument())
+            ->setFiletype('file')
+            ->setTitle('draft-doc-'.$suffix)
+            ->setTemplate(false)
+            ->setReadonly(false)
+            ->setParent($course)
+            ->setCreator($admin)
+            ->addCourseLink($course, null, null, ResourceLink::VISIBILITY_DRAFT)
+        ;
+        $documentRepo->create($draftDoc);
+
+        return [
+            'course' => $course,
+            'teacher' => $teacher,
+            'student' => $student,
+            'attacker' => $attacker,
+            'publishedDoc' => $publishedDoc,
+            'draftDoc' => $draftDoc,
+        ];
+    }
+
+    /**
+     * Extracts the list of document titles from a Hydra collection payload.
+     *
+     * @param array<string, mixed> $payload
+     *
+     * @return array<int, string>
+     */
+    private function extractTitles(array $payload): array
+    {
+        $members = $payload['hydra:member'] ?? [];
+        $titles = [];
+        foreach ($members as $member) {
+            if (isset($member['title'])) {
+                $titles[] = (string) $member['title'];
+            }
+        }
+
+        return $titles;
+    }
+
+    // -------------------------------------------------------------------------
+    // Cross-course enumeration
+    // -------------------------------------------------------------------------
+
+    public function testListDocumentsOfPrivateCourseAsForeignUserIsForbidden(): void
+    {
+        $ctx = $this->bootstrapDocumentScenario('private_foreign');
+
+        $token = $this->getUserTokenFromUser($ctx['attacker']);
+
+        $this->createClientWithCredentials($token)->request(
+            'GET',
+            '/api/documents?cid='.$ctx['course']->getId().'&itemsPerPage=5000',
+        );
+
+        // After the fix the foreign user has no VIEW on the course → 403.
+        // Returning an empty 200 collection would also be acceptable defence,
+        // but we prefer the explicit denial (matches the suggested remediation).
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testListDocumentsWithoutAnyCidAsForeignUserDoesNotLeakOtherCourses(): void
+    {
+        $ctx = $this->bootstrapDocumentScenario('no_cid_foreign');
+
+        $token = $this->getUserTokenFromUser($ctx['attacker']);
+
+        $response = $this->createClientWithCredentials($token)->request(
+            'GET',
+            '/api/documents?itemsPerPage=5000',
+        );
+
+        // No cid context → API Platform rejects the request because `cid` is
+        // declared as a required QueryParameter on the GetCollection. The
+        // validator returns 422 Unprocessable Entity.
+        $this->assertResponseStatusCodeSame(422);
+    }
+
+    // -------------------------------------------------------------------------
+    // Draft visibility — non-teachers must never see DRAFT documents
+    // -------------------------------------------------------------------------
+
+    public function testListDocumentsAsEnrolledStudentExcludesDrafts(): void
+    {
+        $ctx = $this->bootstrapDocumentScenario('student_draft');
+
+        $token = $this->getUserTokenFromUser($ctx['student']);
+
+        $response = $this->createClientWithCredentials($token)->request(
+            'GET',
+            '/api/documents?cid='.$ctx['course']->getId().'&itemsPerPage=5000',
+        );
+
+        $this->assertResponseStatusCodeSame(200);
+
+        $titles = $this->extractTitles($response->toArray());
+        $this->assertContains('published-doc-student_draft', $titles, 'Published document must be visible to enrolled student.');
+        $this->assertNotContains('draft-doc-student_draft', $titles, 'DRAFT document must be filtered out for students.');
+    }
+
+    public function testListDocumentsAsEnrolledTeacherIncludesDrafts(): void
+    {
+        $ctx = $this->bootstrapDocumentScenario('teacher_draft');
+
+        $token = $this->getUserTokenFromUser($ctx['teacher']);
+
+        $response = $this->createClientWithCredentials($token)->request(
+            'GET',
+            '/api/documents?cid='.$ctx['course']->getId().'&itemsPerPage=5000',
+        );
+
+        $this->assertResponseStatusCodeSame(200);
+
+        $titles = $this->extractTitles($response->toArray());
+        $this->assertContains('published-doc-teacher_draft', $titles);
+        $this->assertContains('draft-doc-teacher_draft', $titles, 'Teachers must keep access to DRAFT documents.');
+    }
+
+    public function testListDocumentsAsAdminIncludesDrafts(): void
+    {
+        $ctx = $this->bootstrapDocumentScenario('admin_draft');
+
+        // Default getUserToken() returns the admin/admin token.
+        $response = $this->createClientWithCredentials()->request(
+            'GET',
+            '/api/documents?cid='.$ctx['course']->getId().'&itemsPerPage=5000',
+        );
+
+        $this->assertResponseStatusCodeSame(200);
+
+        $titles = $this->extractTitles($response->toArray());
+        $this->assertContains('published-doc-admin_draft', $titles);
+        $this->assertContains('draft-doc-admin_draft', $titles);
+    }
+
+    // -------------------------------------------------------------------------
+    // Unauthenticated access
+    // -------------------------------------------------------------------------
+
+    public function testListDocumentsRequiresAuthentication(): void
+    {
+        $ctx = $this->bootstrapDocumentScenario('auth_required');
+
+        $response = self::createClient()->request(
+            'GET',
+            '/api/documents?cid='.$ctx['course']->getId(),
+        );
+
+        // The API firewall is JWT-gated. Without a token Symfony evaluates the
+        // operation-level `is_granted('ROLE_USER')` expression against an
+        // anonymous user and denies — yielding 401 (when an entry point sets
+        // the challenge) or 403 (default JWT firewall behaviour). Either is a
+        // valid "unauthenticated" outcome; what must never happen is a 200
+        // with data.
+        $status = $response->getStatusCode();
+        $this->assertContains(
+            $status,
+            [401, 403],
+            'Expected 401 or 403 for an unauthenticated request, got '.$status
+        );
+    }
+
+    // -------------------------------------------------------------------------
+    // Audit findings — separate from the original advisory.
+    // The helpers below piggy-back on bootstrapDocumentScenario(); each test
+    // documents a distinct cross-course / IDOR vector found while auditing.
+    // -------------------------------------------------------------------------
+
+    /**
+     * H1 — `GET /api/documents/{iid}/lp-usage` declares only `ROLE_USER` and
+     * the action does not check VIEW on the target document. A foreign user
+     * must not be able to enumerate the learning paths that reference a
+     * document of a private course they are not enrolled in.
+     */
+    public function testLpUsageOfPrivateDocumentAsForeignUserIsForbidden(): void
+    {
+        $ctx = $this->bootstrapDocumentScenario('lp_usage_foreign');
+
+        $token = $this->getUserTokenFromUser($ctx['attacker']);
+
+        $this->createClientWithCredentials($token)->request(
+            'GET',
+            '/api/documents/'.$ctx['publishedDoc']->getIid().'/lp-usage',
+        );
+
+        // After the fix the endpoint must require VIEW on object.resourceNode.
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    /**
+     * H2 — `GET /api/documents/{cid}/usage` returns storage quotas and
+     * breakdowns of any course as long as the caller is authenticated.
+     * A foreign user must not be able to read the operational metrics of a
+     * private course they are not enrolled in.
+     */
+    public function testUsageOfPrivateCourseAsForeignUserIsForbidden(): void
+    {
+        $ctx = $this->bootstrapDocumentScenario('usage_foreign');
+
+        $token = $this->getUserTokenFromUser($ctx['attacker']);
+
+        $this->createClientWithCredentials($token)->request(
+            'GET',
+            '/api/documents/'.$ctx['course']->getId().'/usage',
+        );
+
+        // After the fix the controller must check CourseVoter::VIEW.
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    /**
+     * H3 — `POST /api/documents` does not require `cid` and does not validate
+     * EDIT on every course referenced in `resourceLinkList`. A teacher of
+     * course A must not be able to create a document linked to course B.
+     */
+    public function testCreateDocumentLinkedToForeignCourseIsForbidden(): void
+    {
+        $victimCtx = $this->bootstrapDocumentScenario('create_victim');
+        $attackerCtx = $this->bootstrapDocumentScenario('create_attacker');
+
+        // The attacker is a teacher in their own course but NOT in victim's.
+        $attackerTeacher = $attackerCtx['teacher'];
+        $token = $this->getUserTokenFromUser($attackerTeacher);
+
+        $this->createClientWithCredentials($token)->request(
+            'POST',
+            '/api/documents?cid='.$attackerCtx['course']->getId(),
+            [
+                'json' => [
+                    'title' => 'injected-from-foreign-course',
+                    'filetype' => 'folder',
+                    'parentResourceNodeId' => $victimCtx['course']->getResourceNode()->getId(),
+                    'resourceLinkList' => [[
+                        'cid' => $victimCtx['course']->getId(),
+                        'visibility' => ResourceLink::VISIBILITY_PUBLISHED,
+                    ]],
+                ],
+            ]
+        );
+
+        // After the fix any resourceLinkList entry pointing to a course where
+        // the user is not teacher/admin must be rejected.
+        $this->assertResponseStatusCodeSame(403);
+
+        // Sanity: no rogue document landed in the victim course.
+        $em = $this->getEntityManager();
+        $em->clear();
+        $rogue = $em->getRepository(CDocument::class)
+            ->findOneBy(['title' => 'injected-from-foreign-course'])
+        ;
+        $this->assertNull($rogue, 'A foreign teacher must not be able to seed documents in another course.');
+    }
+
+    /**
+     * H4 — `POST /api/documents/{iid}/replace` is gated by global/contextual
+     * teacher roles instead of `is_granted('EDIT', object.resourceNode)`. A
+     * teacher of course A must not be able to replace the binary of a
+     * document that belongs to course B.
+     */
+    public function testReplaceDocumentOfForeignCourseIsForbidden(): void
+    {
+        $victimCtx = $this->bootstrapDocumentScenario('replace_victim');
+        $attackerCtx = $this->bootstrapDocumentScenario('replace_attacker');
+
+        $attackerTeacher = $attackerCtx['teacher'];
+        $token = $this->getUserTokenFromUser($attackerTeacher);
+
+        $file = $this->getUploadedFile();
+
+        $this->createClientWithCredentials($token)->request(
+            'POST',
+            '/api/documents/'.$victimCtx['publishedDoc']->getIid().'/replace?cid='.$attackerCtx['course']->getId(),
+            [
+                'headers' => ['Content-Type' => 'multipart/form-data'],
+                'extra' => ['files' => ['file' => $file]],
+            ]
+        );
+
+        // After the fix the operation must require EDIT on object.resourceNode.
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    // -------------------------------------------------------------------------
+    // Phase 3 — Regression tests for contextual-role migration (issue #8486).
+    //
+    // The following endpoints used to require only `ROLE_USER`, letting any
+    // authenticated user invoke them. They now require contextual roles
+    // (ROLE_CURRENT_COURSE_STUDENT / ROLE_CURRENT_COURSE_SESSION_STUDENT)
+    // populated by CourseContextRoleListener once CidReqListener has resolved
+    // the `cid` query parameter.
+    // -------------------------------------------------------------------------
+
+    public function testDownloadSelectedAsForeignUserIsForbidden(): void
+    {
+        $ctx = $this->bootstrapDocumentScenario('dl_sel_foreign');
+
+        $token = $this->getUserTokenFromUser($ctx['attacker']);
+
+        $this->createClientWithCredentials($token)->request(
+            'POST',
+            '/api/documents/download-selected?cid='.$ctx['course']->getId(),
+            [
+                'headers' => [
+                    'Accept' => 'application/zip',
+                    'Content-Type' => 'application/json',
+                ],
+                'body' => json_encode([
+                    'ids' => [$ctx['publishedDoc']->getIid()],
+                    'compressed' => true,
+                ], JSON_THROW_ON_ERROR),
+            ]
+        );
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testDownloadSelectedWithoutCidIsForbidden(): void
+    {
+        $ctx = $this->bootstrapDocumentScenario('dl_sel_no_cid');
+
+        $token = $this->getUserTokenFromUser($ctx['student']);
+
+        $this->createClientWithCredentials($token)->request(
+            'POST',
+            '/api/documents/download-selected',
+            [
+                'headers' => [
+                    'Accept' => 'application/zip',
+                    'Content-Type' => 'application/json',
+                ],
+                'body' => json_encode([
+                    'ids' => [$ctx['publishedDoc']->getIid()],
+                    'compressed' => true,
+                ], JSON_THROW_ON_ERROR),
+            ]
+        );
+
+        // Without cid the listener cannot publish contextual roles → security
+        // expression fails even for an otherwise-enrolled student.
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testDownloadSelectedAsEnrolledStudentIsAllowed(): void
+    {
+        $ctx = $this->bootstrapDocumentScenario('dl_sel_student');
+
+        $token = $this->getUserTokenFromUser($ctx['student']);
+
+        $response = $this->createClientWithCredentials($token)->request(
+            'POST',
+            '/api/documents/download-selected?cid='.$ctx['course']->getId(),
+            [
+                'headers' => [
+                    'Accept' => 'application/zip',
+                    'Content-Type' => 'application/json',
+                ],
+                'body' => json_encode([
+                    'ids' => [$ctx['publishedDoc']->getIid()],
+                    'compressed' => true,
+                ], JSON_THROW_ON_ERROR),
+            ]
+        );
+
+        // Security must pass for the enrolled student. The controller may
+        // still fail later if the physical file is missing in the test
+        // environment, but the security gate must not reject (403).
+        $this->assertNotSame(
+            403,
+            $response->getStatusCode(),
+            'Enrolled student with valid cid must pass the security expression.'
+        );
+    }
+
+    public function testDownloadAllAsForeignUserIsForbidden(): void
+    {
+        $ctx = $this->bootstrapDocumentScenario('dl_all_foreign');
+
+        $token = $this->getUserTokenFromUser($ctx['attacker']);
+
+        $this->createClientWithCredentials($token)->request(
+            'POST',
+            '/api/documents/download-all?cid='.$ctx['course']->getId(),
+            [
+                'headers' => [
+                    'Accept' => 'application/zip',
+                    'Content-Type' => 'application/json',
+                ],
+                'body' => json_encode([
+                    'rootNodeId' => $ctx['course']->getResourceNode()->getId(),
+                ], JSON_THROW_ON_ERROR),
+            ]
+        );
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testDownloadAllWithoutCidIsForbidden(): void
+    {
+        $ctx = $this->bootstrapDocumentScenario('dl_all_no_cid');
+
+        $token = $this->getUserTokenFromUser($ctx['student']);
+
+        $this->createClientWithCredentials($token)->request(
+            'POST',
+            '/api/documents/download-all',
+            [
+                'headers' => [
+                    'Accept' => 'application/zip',
+                    'Content-Type' => 'application/json',
+                ],
+                'body' => json_encode([
+                    'rootNodeId' => $ctx['course']->getResourceNode()->getId(),
+                ], JSON_THROW_ON_ERROR),
+            ]
+        );
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testDownloadAllAsEnrolledStudentIsAllowed(): void
+    {
+        $ctx = $this->bootstrapDocumentScenario('dl_all_student');
+
+        $token = $this->getUserTokenFromUser($ctx['student']);
+
+        $response = $this->createClientWithCredentials($token)->request(
+            'POST',
+            '/api/documents/download-all?cid='.$ctx['course']->getId(),
+            [
+                'headers' => [
+                    'Accept' => 'application/zip',
+                    'Content-Type' => 'application/json',
+                ],
+                'body' => json_encode([
+                    'rootNodeId' => $ctx['course']->getResourceNode()->getId(),
+                ], JSON_THROW_ON_ERROR),
+            ]
+        );
+
+        $this->assertNotSame(
+            403,
+            $response->getStatusCode(),
+            'Enrolled student with valid cid must pass the security expression.'
+        );
+    }
+}

From b7377565cef8741507fd285743fa119714b006bc Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Mon, 25 May 2026 20:04:03 -0500
Subject: [PATCH 05/38] Security: Enforce course-teacher validation for
 `resourceLinkList` in `CreateDocumentFileAction` to prevent IDOR
 vulnerabilities

---
 .../Api/CreateDocumentFileAction.php          | 71 +++++++++++++++++++
 src/CourseBundle/Entity/CDocument.php         |  2 +-
 2 files changed, 72 insertions(+), 1 deletion(-)

diff --git a/src/CoreBundle/Controller/Api/CreateDocumentFileAction.php b/src/CoreBundle/Controller/Api/CreateDocumentFileAction.php
index 6f2c8a13e21..d3f56dea9ef 100644
--- a/src/CoreBundle/Controller/Api/CreateDocumentFileAction.php
+++ b/src/CoreBundle/Controller/Api/CreateDocumentFileAction.php
@@ -6,13 +6,16 @@
 
 namespace Chamilo\CoreBundle\Controller\Api;
 
+use Chamilo\CoreBundle\Entity\User;
 use Chamilo\CoreBundle\Helpers\AiDisclosureHelper;
 use Chamilo\CoreBundle\Helpers\CourseHelper;
 use Chamilo\CoreBundle\Repository\Node\CourseRepository;
 use Chamilo\CourseBundle\Entity\CDocument;
 use Chamilo\CourseBundle\Repository\CDocumentRepository;
 use Doctrine\ORM\EntityManager;
+use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 use Symfony\Component\HttpKernel\KernelInterface;
 use Symfony\Contracts\Translation\TranslatorInterface;
@@ -48,7 +51,14 @@ public function __invoke(
         CourseRepository $courseRepository,
         CourseHelper $courseHelper,
         AiDisclosureHelper $aiDisclosureHelper,
+        Security $security,
     ): CDocument {
+        // Reject any resourceLinkList entry pointing to a course where the
+        // caller is not a teacher (admins bypass). The operation-level
+        // security expression only validates the role for the query `cid`,
+        // so the body could otherwise target a foreign course (IDOR).
+        $this->assertUserCanLinkToCourses($request, $security, $courseRepository);
+
         $isUncompressZipEnabled = (string) $request->get('isUncompressZipEnabled', 'false');
         $fileExistsOption = (string) $request->get('fileExistsOption', 'rename');
         $aiAssistedRaw = strtolower(trim((string) $request->get('ai_assisted', '')));
@@ -153,4 +163,65 @@ private function isAllowedCloudLinkHost(string $host): bool
 
         return false;
     }
+
+    private function assertUserCanLinkToCourses(
+        Request $request,
+        Security $security,
+        CourseRepository $courseRepository,
+    ): void {
+        $user = $security->getUser();
+        if (!$user instanceof User) {
+            throw new AccessDeniedHttpException('Authentication required.');
+        }
+
+        if ($security->isGranted('ROLE_ADMIN')) {
+            return;
+        }
+
+        $resourceLinkList = $this->extractResourceLinkList($request);
+        foreach ($resourceLinkList as $entry) {
+            if (!\is_array($entry)) {
+                continue;
+            }
+
+            $cid = (int) ($entry['cid'] ?? 0);
+            if ($cid <= 0) {
+                continue;
+            }
+
+            $course = $courseRepository->find($cid);
+            if (null === $course || !$course->hasUserAsTeacher($user)) {
+                throw new AccessDeniedHttpException('You are not a teacher of one of the referenced courses.');
+            }
+        }
+    }
+
+    /**
+     * @return array<int, mixed>
+     */
+    private function extractResourceLinkList(Request $request): array
+    {
+        $raw = (string) $request->getContent();
+        if ('' !== $raw) {
+            $decoded = json_decode($raw, true);
+            if (\is_array($decoded) && isset($decoded['resourceLinkList']) && \is_array($decoded['resourceLinkList'])) {
+                return $decoded['resourceLinkList'];
+            }
+        }
+
+        $fromForm = $request->get('resourceLinkList', []);
+        if (\is_array($fromForm)) {
+            return $fromForm;
+        }
+
+        if (\is_string($fromForm) && '' !== $fromForm) {
+            $normalized = str_contains($fromForm, '[') ? $fromForm : '['.$fromForm.']';
+            $decoded = json_decode($normalized, true);
+            if (\is_array($decoded)) {
+                return $decoded;
+            }
+        }
+
+        return [];
+    }
 }
diff --git a/src/CourseBundle/Entity/CDocument.php b/src/CourseBundle/Entity/CDocument.php
index 093beda9424..3a998e88253 100644
--- a/src/CourseBundle/Entity/CDocument.php
+++ b/src/CourseBundle/Entity/CDocument.php
@@ -98,7 +98,7 @@
                     ]),
                 ),
             ),
-            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER') or is_granted('ROLE_TEACHER')",
+            security: "is_granted('EDIT', object.resourceNode)",
             validationContext: ['groups' => ['Default', 'media_object_create', 'document:write']],
             deserialize: false
         ),

From 2c88ac5b4895013c801f6a1fc366a425652031c4 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Tue, 26 May 2026 03:36:51 -0500
Subject: [PATCH 06/38] Introduce `OptionalCourseLinkFilter` to allow optional
 `cid` handling in API requests

---
 src/CoreBundle/Filter/CidFilter.php               |  9 +++++++--
 .../Filter/OptionalCourseLinkFilter.php           | 15 +++++++++++++++
 src/CourseBundle/Entity/CCalendarEvent.php        |  4 ++--
 src/CourseBundle/Entity/CDocument.php             | 14 --------------
 4 files changed, 24 insertions(+), 18 deletions(-)
 create mode 100644 src/CoreBundle/Filter/OptionalCourseLinkFilter.php

diff --git a/src/CoreBundle/Filter/CidFilter.php b/src/CoreBundle/Filter/CidFilter.php
index ac21bda8b97..6ca02f858fd 100644
--- a/src/CoreBundle/Filter/CidFilter.php
+++ b/src/CoreBundle/Filter/CidFilter.php
@@ -41,8 +41,8 @@ public function getDescription(string $resourceClass): array
         return [
             'cid' => [
                 'property' => null,
-                'type' => 'int',
-                'required' => false,
+                'type' => 'string',
+                'required' => $this->isRequired(),
                 'description' => 'Course identifier',
             ],
         ];
@@ -76,4 +76,9 @@ protected function filterProperty(
             ->setParameter('course', $course->getId())
         ;
     }
+
+    public function isRequired(): bool
+    {
+        return true;
+    }
 }
diff --git a/src/CoreBundle/Filter/OptionalCourseLinkFilter.php b/src/CoreBundle/Filter/OptionalCourseLinkFilter.php
new file mode 100644
index 00000000000..f297c416877
--- /dev/null
+++ b/src/CoreBundle/Filter/OptionalCourseLinkFilter.php
@@ -0,0 +1,15 @@
+<?php
+
+/* For licensing terms, see /license.txt */
+
+declare(strict_types=1);
+
+namespace Chamilo\CoreBundle\Filter;
+
+class OptionalCourseLinkFilter extends CidFilter
+{
+    public function isRequired(): bool
+    {
+        return false;
+    }
+}
diff --git a/src/CourseBundle/Entity/CCalendarEvent.php b/src/CourseBundle/Entity/CCalendarEvent.php
index 248fd41acd9..d95f0bc7c33 100644
--- a/src/CourseBundle/Entity/CCalendarEvent.php
+++ b/src/CourseBundle/Entity/CCalendarEvent.php
@@ -24,8 +24,8 @@
 use Chamilo\CoreBundle\Entity\ResourceInterface;
 use Chamilo\CoreBundle\Entity\ResourceRestrictToGroupContextInterface;
 use Chamilo\CoreBundle\Entity\Room;
-use Chamilo\CoreBundle\Filter\CidFilter;
 use Chamilo\CoreBundle\Filter\GlobalEventFilter;
+use Chamilo\CoreBundle\Filter\OptionalCourseLinkFilter;
 use Chamilo\CoreBundle\Filter\SidFilter;
 use Chamilo\CoreBundle\State\CalendarEventStateProvider;
 use Chamilo\CoreBundle\State\CCalendarEventStateProcessor;
@@ -73,7 +73,7 @@
 #[ORM\Entity(repositoryClass: CCalendarEventRepository::class)]
 #[ApiFilter(filterClass: SearchFilter::class, properties: ['allDay' => 'boolean'])]
 #[ApiFilter(filterClass: DateFilter::class, strategy: 'exclude_null')]
-#[ApiFilter(filterClass: CidFilter::class)]
+#[ApiFilter(filterClass: OptionalCourseLinkFilter::class)]
 #[ApiFilter(filterClass: SidFilter::class)]
 #[ApiFilter(GlobalEventFilter::class, properties: ['type'])]
 class CCalendarEvent extends AbstractResource implements ResourceInterface, ResourceRestrictToGroupContextInterface, Stringable
diff --git a/src/CourseBundle/Entity/CDocument.php b/src/CourseBundle/Entity/CDocument.php
index 3a998e88253..d50099d3abb 100644
--- a/src/CourseBundle/Entity/CDocument.php
+++ b/src/CourseBundle/Entity/CDocument.php
@@ -249,22 +249,8 @@
             deserialize: false
         ),
         new GetCollection(
-            parameters: [
-                'cid' => new QueryParameter(
-                    required: true,
-                    schema: ['type' => 'integer'],
-                    description: 'Course identifier',
-                ),
-            ],
             openapi: new Operation(
                 parameters: [
-                    new Parameter(
-                        name: 'cid',
-                        in: 'query',
-                        description: 'Course identifier',
-                        required: true,
-                        schema: ['type' => 'integer'],
-                    ),
                     new Parameter(
                         name: 'resourceNode.parent',
                         in: 'query',

From fc2d92a5932d1e197c69f0059168a11ac00220bb Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Tue, 26 May 2026 03:57:59 -0500
Subject: [PATCH 07/38] Replace manual `cid`, `sid`, and `gid` handling with
 `CidReqHelper` for cleaner context management in
 `DocumentCollectionStateProvider`

---
 .../State/DocumentCollectionStateProvider.php | 61 +++++++++----------
 1 file changed, 28 insertions(+), 33 deletions(-)

diff --git a/src/CoreBundle/State/DocumentCollectionStateProvider.php b/src/CoreBundle/State/DocumentCollectionStateProvider.php
index cb7fc504793..ae8ae611364 100644
--- a/src/CoreBundle/State/DocumentCollectionStateProvider.php
+++ b/src/CoreBundle/State/DocumentCollectionStateProvider.php
@@ -17,6 +17,7 @@
 use Chamilo\CoreBundle\Entity\Session;
 use Chamilo\CoreBundle\Entity\User;
 use Chamilo\CoreBundle\Helpers\AccessUrlHelper;
+use Chamilo\CoreBundle\Helpers\CidReqHelper;
 use Chamilo\CoreBundle\Repository\ResourceLinkRepository;
 use Chamilo\CoreBundle\Settings\SettingsManager;
 use Chamilo\CourseBundle\Entity\CDocument;
@@ -51,6 +52,7 @@ public function __construct(
         private readonly CacheInterface $documentListCache,
         #[Autowire('%kernel.secret%')]
         private readonly string $appSecret,
+        private readonly CidReqHelper $cidReqHelper,
     ) {}
 
     /**
@@ -80,9 +82,9 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
         ;
 
         $query = $request->query->all();
-        $cid = (int) ($query['cid'] ?? 0);
-        $sid = (int) ($query['sid'] ?? 0);
-        $gid = (int) ($query['gid'] ?? 0);
+        $course = $this->cidReqHelper->getCourseEntity();
+        $session = $this->cidReqHelper->getSessionEntity();
+        $group = $this->cidReqHelper->getGroupEntity();
 
         $page = max(1, (int) ($query['page'] ?? 1));
         $itemsPerPage = (int) ($query['itemsPerPage'] ?? 20);
@@ -93,11 +95,11 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
             $itemsPerPage = 5000;
         }
 
-        $hasContext = $cid > 0 || $sid > 0 || $gid > 0;
+        $hasContext = $course || $session || $group;
 
         // By default, documents must be visible in session context including base course content,
         // because CDocument implements ResourceShowCourseResourcesInSessionInterface.
-        $includeBaseContent = $sid > 0
+        $includeBaseContent = $session
             && is_a(CDocument::class, ResourceShowCourseResourcesInSessionInterface::class, true);
 
         // Allow API clients to override behavior (withBaseContent=0/1).
@@ -173,7 +175,7 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
             $hiddenSystemTypes[] = 'user_folder_ses';
         } else {
             // When enabled, never show session-scoped shared folders in base course context.
-            if ($sid <= 0) {
+            if (!$session) {
                 $hiddenSystemTypes[] = 'user_folder_ses';
             }
         }
@@ -230,11 +232,11 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
                 ;
             }
 
-            if ($cid > 0) {
-                $qb->andWhere('IDENTITY(rl.course) = :cid')->setParameter('cid', $cid);
+            if ($course) {
+                $qb->andWhere('IDENTITY(rl.course) = :cid')->setParameter('cid', $course->getId());
             }
 
-            if ($sid > 0) {
+            if ($session) {
                 if ($includeBaseContent) {
                     // Include both session content and base course content.
                     $qb
@@ -245,12 +247,12 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
                                 'IDENTITY(rl.session) = 0'
                             )
                         )
-                        ->setParameter('sid', $sid)
+                        ->setParameter('sid', $session->getId())
                     ;
                 } else {
                     $qb
                         ->andWhere('IDENTITY(rl.session) = :sid')
-                        ->setParameter('sid', $sid)
+                        ->setParameter('sid', $session->getId())
                     ;
                 }
             } else {
@@ -262,8 +264,8 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
                 );
             }
 
-            if ($gid > 0) {
-                $qb->andWhere('IDENTITY(rl.group) = :gid')->setParameter('gid', $gid);
+            if ($group) {
+                $qb->andWhere('IDENTITY(rl.group) = :gid')->setParameter('gid', $group->getIid());
             } else {
                 $qb->andWhere('rl.group IS NULL');
             }
@@ -279,10 +281,6 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
                     /** @var ResourceLinkRepository $linkRepo */
                     $linkRepo = $this->entityManager->getRepository(ResourceLink::class);
 
-                    $courseEntity = $cid > 0 ? $this->entityManager->getRepository(Course::class)->find($cid) : null;
-                    $sessionEntity = $sid > 0 ? $this->entityManager->getRepository(Session::class)->find($sid) : null;
-                    $groupEntity = $gid > 0 ? $this->entityManager->getRepository(CGroup::class)->find($gid) : null;
-
                     // Resolve possible folder links:
                     // - session link (sid=current session)
                     // - base link (sid=NULL), when base content is enabled in session view
@@ -290,9 +288,9 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
 
                     $sessionParentLink = $linkRepo->findParentLinkForContext(
                         $folderNode,
-                        $courseEntity,
-                        $sessionEntity,
-                        $groupEntity,
+                        $course,
+                        $session,
+                        $group,
                         null,
                         null
                     );
@@ -300,12 +298,12 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
                         $parentLinkIds[] = (int) $sessionParentLink->getId();
                     }
 
-                    if ($sid > 0 && $includeBaseContent && null !== $courseEntity) {
+                    if ($session && $includeBaseContent && $course) {
                         $baseParentLink = $linkRepo->findParentLinkForContext(
                             $folderNode,
-                            $courseEntity,
+                            $course,
                             null,
-                            $groupEntity,
+                            $group,
                             null,
                             null
                         );
@@ -413,7 +411,7 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
         //   - the access_url ID so that multi-portal setups within one installation
         //     are also isolated.
         $accessUrlId = $this->accessUrlHelper->getCurrent()?->getId() ?? 1;
-        $viewerProfileBucket = $this->getViewerProfileCacheBucket($cid, $sid);
+        $viewerProfileBucket = $this->getViewerProfileCacheBucket($course, $session);
         $sortedTypes = $effectiveFiletypes;
         sort($sortedTypes);
         $sortedHidden = $hiddenSystemTypes;
@@ -421,9 +419,9 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
         $cacheKey = 'doc_list_'.$this->getInstallationPrefix().'_'.hash('md5', serialize([
             $accessUrlId,
             $viewerProfileBucket,
-            $cid,
-            $sid,
-            $gid,
+            $course?->getId() ?? 0,
+            $session?->getId() ?? 0,
+            $group?->getIid() ?? 0,
             $parentNodeId,
             $loadNode,
             $sortedTypes,
@@ -581,7 +579,7 @@ private function getInstallationPrefix(): string
         return $this->installationPrefix;
     }
 
-    private function getViewerProfileCacheBucket(int $cid, int $sid): string
+    private function getViewerProfileCacheBucket(?Course $course, ?Session $session): string
     {
         $user = $this->security->getUser();
 
@@ -593,10 +591,7 @@ private function getViewerProfileCacheBucket(int $cid, int $sid): string
             return 'admin';
         }
 
-        $course = $cid > 0 ? $this->entityManager->getRepository(Course::class)->find($cid) : null;
-        $session = $sid > 0 ? $this->entityManager->getRepository(Session::class)->find($sid) : null;
-
-        if ($session instanceof Session && $course instanceof Course) {
+        if ($session instanceof Session && $course) {
             $userIsGeneralCoach = $session->hasUserAsGeneralCoach($user);
             $userIsCourseCoach = $session->hasCourseCoachInCourse($user, $course);
             $userIsStudent = $session->hasUserInCourse($user, $course, Session::STUDENT);
@@ -610,7 +605,7 @@ private function getViewerProfileCacheBucket(int $cid, int $sid): string
             }
         }
 
-        if ($course instanceof Course) {
+        if ($course) {
             if ($course->hasUserAsTeacher($user)) {
                 return 'teacher';
             }

From 828158e0e8605e6ff239b7a237f097fa0e491e2a Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Tue, 26 May 2026 05:18:54 -0500
Subject: [PATCH 08/38] Enforce contextual course security roles and improve
 attendance API handling with parameterized context management.

---
 assets/vue/services/attendanceService.js | 15 ++++++++++++---
 src/CourseBundle/Entity/CAttendance.php  | 14 ++++++++++----
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/assets/vue/services/attendanceService.js b/assets/vue/services/attendanceService.js
index dd2ab86ff6b..d878ae1bd1b 100644
--- a/assets/vue/services/attendanceService.js
+++ b/assets/vue/services/attendanceService.js
@@ -47,8 +47,12 @@ export default {
   },
 
   /**
-   * Creates a new attendance list.
-   * @param {Object} data - Data for the new attendance list.
+   * Creates a new attendance list. The course context is mirrored from the
+   * request body to the query string so CidReqListener can resolve it and
+   * CourseContextRoleListener can publish the contextual TEACHER role that
+   * the operation requires.
+   *
+   * @param {Object} data - Data for the new attendance list (includes cid, sid).
    * @returns {Promise<Object>} - Data of the created attendance list.
    */
   createAttendance: async (data) => {
@@ -66,8 +70,13 @@ export default {
   },
 
   /**
-   * Deletes an attendance list.
+   * Deletes an attendance list. The course context (cid, optional sid/gid)
+   * must be supplied as query parameters so CidReqListener can resolve the
+   * course and CourseContextRoleListener can publish the contextual TEACHER
+   * role that the operation requires.
+   *
    * @param {Number|String} attendanceId - ID of the attendance list.
+   * @param {{cid: Number|String, sid?: Number|String, gid?: Number|String}} context
    * @returns {Promise<Object>} - Result of the deletion.
    */
   deleteAttendance: async (attendanceId) => {
diff --git a/src/CourseBundle/Entity/CAttendance.php b/src/CourseBundle/Entity/CAttendance.php
index 5035a24644a..5df72b61226 100644
--- a/src/CourseBundle/Entity/CAttendance.php
+++ b/src/CourseBundle/Entity/CAttendance.php
@@ -18,6 +18,7 @@
 use ApiPlatform\OpenApi\Model\Parameter;
 use Chamilo\CoreBundle\Entity\AbstractResource;
 use Chamilo\CoreBundle\Entity\ResourceInterface;
+use Chamilo\CoreBundle\Filter\CidFilter;
 use Chamilo\CoreBundle\Filter\SidFilter;
 use Chamilo\CoreBundle\State\CAttendanceStateProcessor;
 use Chamilo\CourseBundle\Repository\CAttendanceRepository;
@@ -50,13 +51,16 @@
             name: 'soft_delete',
             processor: CAttendanceStateProcessor::class
         ),
-        new Delete(security: "is_granted('ROLE_TEACHER')"),
+        new Delete(
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
+        ),
         new Post(
             uriTemplate: '/attendances/{iid}/calendars',
             openapi: new Operation(
                 summary: 'Add a calendar to an attendance.'
             ),
             denormalizationContext: ['groups' => ['attendance:write']],
+            security: "is_granted('EDIT', object.resourceNode)",
             name: 'calendar_add',
             processor: CAttendanceStateProcessor::class
         ),
@@ -72,16 +76,17 @@
                     ),
                 ],
             ),
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
         ),
-        new Get(security: "is_granted('ROLE_USER')"),
+        new Get(security: "is_granted('VIEW', object.resourceNode)"),
         new Post(
             denormalizationContext: ['groups' => ['attendance:write']],
-            security: "is_granted('ROLE_TEACHER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             validationContext: ['groups' => ['Default']]
         ),
         new Put(
             denormalizationContext: ['groups' => ['attendance:write']],
-            security: "is_granted('ROLE_TEACHER')"
+            security: "is_granted('EDIT', object.resourceNode)"
         ),
     ],
     normalizationContext: [
@@ -92,6 +97,7 @@
     paginationEnabled: true,
 )]
 #[ApiFilter(SearchFilter::class, properties: ['active' => 'exact', 'title' => 'partial', 'resourceNode.parent' => 'exact'])]
+#[ApiFilter(filterClass: CidFilter::class)]
 #[ApiFilter(filterClass: SidFilter::class)]
 #[ORM\Table(name: 'c_attendance')]
 #[ORM\Index(columns: ['active'], name: 'active')]

From 0035108fb4ae0dfeaa7f44357c3124437f14d8e7 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Tue, 26 May 2026 08:19:11 -0500
Subject: [PATCH 09/38] Security: Enforce contextual validation of
 `resourceLinkList` in `CreateCBlogAction` to prevent bypassing course,
 session, or group access gates.

---
 .../Controller/Api/CreateCBlogAction.php      | 50 +++++++++++++++++++
 src/CourseBundle/Entity/CBlog.php             |  6 ++-
 2 files changed, 54 insertions(+), 2 deletions(-)

diff --git a/src/CoreBundle/Controller/Api/CreateCBlogAction.php b/src/CoreBundle/Controller/Api/CreateCBlogAction.php
index d3917962645..6300027fc6d 100644
--- a/src/CoreBundle/Controller/Api/CreateCBlogAction.php
+++ b/src/CoreBundle/Controller/Api/CreateCBlogAction.php
@@ -16,6 +16,7 @@
 use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Attribute\AsController;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 
 #[AsController]
 class CreateCBlogAction extends BaseResourceFileAction
@@ -42,6 +43,12 @@ public function __invoke(
             $resourceLinkList = \is_array($resourceLinkListRaw) ? $resourceLinkListRaw : [];
         }
 
+        // The `cid` (and optional `sid`/`gid`) query parameter establishes the
+        // course context that gated the security expression. Any
+        // resourceLinkList entry that points to a different context would
+        // bypass that gate, so we reject the request outright.
+        $this->assertResourceLinkListMatchesQueryContext($request, $resourceLinkList, $security);
+
         $blog = (new CBlog())
             ->setTitle($title)
             ->setBlogSubtitle($subtitle)
@@ -89,4 +96,47 @@ private function handleShortcutCreation(
             $shortcutRepository->addShortCut($blog, $currentUser, $course, $session);
         }
     }
+
+    /**
+     * @param array<int, mixed> $resourceLinkList
+     */
+    private function assertResourceLinkListMatchesQueryContext(
+        Request $request,
+        array $resourceLinkList,
+        Security $security,
+    ): void {
+        if ($security->isGranted('ROLE_ADMIN')) {
+            return;
+        }
+
+        if ([] === $resourceLinkList) {
+            return;
+        }
+
+        $queryCid = (int) $request->query->get('cid');
+        $querySid = (int) $request->query->get('sid');
+        $queryGid = (int) $request->query->get('gid');
+
+        foreach ($resourceLinkList as $entry) {
+            if (!\is_array($entry)) {
+                continue;
+            }
+
+            $entryCid = (int) ($entry['cid'] ?? 0);
+            $entrySid = (int) ($entry['sid'] ?? 0);
+            $entryGid = (int) ($entry['gid'] ?? 0);
+
+            if ($entryCid > 0 && $entryCid !== $queryCid) {
+                throw new AccessDeniedHttpException('resourceLinkList course does not match the request context.');
+            }
+
+            if ($entrySid > 0 && $entrySid !== $querySid) {
+                throw new AccessDeniedHttpException('resourceLinkList session does not match the request context.');
+            }
+
+            if ($entryGid > 0 && $entryGid !== $queryGid) {
+                throw new AccessDeniedHttpException('resourceLinkList group does not match the request context.');
+            }
+        }
+    }
 }
diff --git a/src/CourseBundle/Entity/CBlog.php b/src/CourseBundle/Entity/CBlog.php
index 48e46ae0101..13316d63f6d 100644
--- a/src/CourseBundle/Entity/CBlog.php
+++ b/src/CourseBundle/Entity/CBlog.php
@@ -37,7 +37,9 @@
 #[ORM\Table(name: 'c_blog')]
 #[ApiResource(
     operations: [
-        new GetCollection(security: "is_granted('ROLE_USER')"),
+        new GetCollection(
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
+        ),
         new Post(
             controller: CreateCBlogAction::class,
             openapi: new Operation(
@@ -65,7 +67,7 @@
                     ]),
                 ),
             ),
-            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER') or is_granted('ROLE_TEACHER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             validationContext: ['groups' => ['Default', 'blog:write']],
             deserialize: false
         ),

From bb1c4c6a1e3743d2b2b56495e387d916e59e81d4 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:31:41 -0500
Subject: [PATCH 10/38] Security: Glossary: Enforce contextual course roles on
 API operations

Remove the platform-wide ROLE_TEACHER fallback from the create/import/export
operations (it allowed any teacher of the platform to operate on any course),
and add a contextual read role to the GetCollection that previously relied on
the default ROLE_USER firewall check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CGlossary.php | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/CourseBundle/Entity/CGlossary.php b/src/CourseBundle/Entity/CGlossary.php
index 6292df7ced9..b054ce9785a 100644
--- a/src/CourseBundle/Entity/CGlossary.php
+++ b/src/CourseBundle/Entity/CGlossary.php
@@ -84,7 +84,7 @@
                     ]),
                 ),
             ),
-            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER') or is_granted('ROLE_TEACHER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             validationContext: ['groups' => ['Default', 'media_object_create', 'glossary:write']],
             deserialize: false
         ),
@@ -127,7 +127,8 @@
                         ],
                     ),
                 ],
-            )
+            ),
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
         ),
         new Post(
             uriTemplate: '/glossaries/import',
@@ -155,21 +156,21 @@
                     ),
                 ],
             ),
-            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER') or is_granted('ROLE_TEACHER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             validationContext: ['groups' => ['Default', 'media_object_create', 'glossary:write']],
             deserialize: false
         ),
         new Post(
             uriTemplate: '/glossaries/export',
             controller: ExportCGlossaryAction::class,
-            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER') or is_granted('ROLE_TEACHER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             validationContext: ['groups' => ['Default', 'media_object_create', 'glossary:write']],
             deserialize: false
         ),
         new Post(
             uriTemplate: '/glossaries/export_to_documents',
             controller: ExportGlossaryToDocumentsAction::class,
-            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER') or is_granted('ROLE_TEACHER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             validationContext: ['groups' => ['Default', 'media_object_create', 'glossary:write']],
             deserialize: false
         ),

From a5f722ff686ceda7546c5e13171f0dee2542860b Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:33:27 -0500
Subject: [PATCH 11/38] Security: Link: Enforce contextual course roles on API
 operations

Drop the platform-wide ROLE_TEACHER fallback from the create/export operations
and add a contextual read role to the GetCollection that previously relied on
the default ROLE_USER firewall check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CLink.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/CourseBundle/Entity/CLink.php b/src/CourseBundle/Entity/CLink.php
index e16b82746d7..18614998812 100644
--- a/src/CourseBundle/Entity/CLink.php
+++ b/src/CourseBundle/Entity/CLink.php
@@ -99,7 +99,7 @@
                     ]),
                 ),
             ),
-            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER') or is_granted('ROLE_TEACHER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             validationContext: ['groups' => ['Default', 'media_object_create', 'link:write']],
             deserialize: false
         ),
@@ -157,7 +157,7 @@
                     ]),
                 ),
             ),
-            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER') or is_granted('ROLE_TEACHER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             deserialize: false
         ),
         new Get(security: "is_granted('VIEW', object.resourceNode)"),
@@ -204,7 +204,8 @@
                         schema: ['type' => 'integer'],
                     ),
                 ],
-            )
+            ),
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
         ),
     ],
     normalizationContext: [

From 43bc378500662706ae9ca7f33706cad2ec559924 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:35:45 -0500
Subject: [PATCH 12/38] Security: LinkCategory: Enforce contextual course roles
 on API operations

Drop the platform-wide ROLE_TEACHER fallback from the create operation and add
a contextual read role to the GetCollection that previously relied on the
default ROLE_USER firewall check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CLinkCategory.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/CourseBundle/Entity/CLinkCategory.php b/src/CourseBundle/Entity/CLinkCategory.php
index 0935e2da916..35c5dca14da 100644
--- a/src/CourseBundle/Entity/CLinkCategory.php
+++ b/src/CourseBundle/Entity/CLinkCategory.php
@@ -88,7 +88,7 @@
                     ]),
                 ),
             ),
-            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER') or is_granted('ROLE_TEACHER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             validationContext: ['groups' => ['Default', 'media_object_create', 'link_category:write']],
             deserialize: false
         ),
@@ -123,7 +123,8 @@
                         ],
                     ),
                 ],
-            )
+            ),
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
         ),
     ],
     normalizationContext: [

From ff882ffde2fc544e5cd529f4d95f2568c9a4606e Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:38:29 -0500
Subject: [PATCH 13/38] Security: LearningPathCategory: Enforce contextual
 course roles on API operations

Replace the lax ROLE_USER check on the item Get with an object-level VIEW on the
resource node, and add a contextual read role to the GetCollection (CidFilter
already scopes results to the requested course).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CLpCategory.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/CourseBundle/Entity/CLpCategory.php b/src/CourseBundle/Entity/CLpCategory.php
index ce9284812ab..23df651f2a4 100644
--- a/src/CourseBundle/Entity/CLpCategory.php
+++ b/src/CourseBundle/Entity/CLpCategory.php
@@ -34,8 +34,9 @@
             openapi: new Operation(
                 summary: 'List LP categories by course (resourceNode.parent) or sid',
             ),
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
         ),
-        new Get(security: "is_granted('ROLE_USER')"),
+        new Get(security: "is_granted('VIEW', object.resourceNode)"),
     ],
     normalizationContext: [
         'groups' => ['lp_category:read', 'resource_node:read', 'resource_link:read'],

From e9cd03b7a39173ec838f1cd576e2d677abf6d20a Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:40:09 -0500
Subject: [PATCH 14/38] Security: LearningPath: Enforce contextual course roles
 on API operations

Replace the lax ROLE_USER on the item Get with an object-level VIEW, add a
contextual read role to the GetCollection, and swap the platform-wide
ROLE_TEACHER/ROLE_ADMIN check on create and reorder for contextual teacher
roles (admins keep access via the role hierarchy).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CLp.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/CourseBundle/Entity/CLp.php b/src/CourseBundle/Entity/CLp.php
index e0634148de8..5d3691fd545 100644
--- a/src/CourseBundle/Entity/CLp.php
+++ b/src/CourseBundle/Entity/CLp.php
@@ -70,8 +70,9 @@
             paginationClientEnabled: true,
             name: 'get_lp_collection_with_progress',
             provider: LpCollectionStateProvider::class,
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
         ),
-        new Get(security: "is_granted('ROLE_USER')"),
+        new Get(security: "is_granted('VIEW', object.resourceNode)"),
         new Post(
             controller: CreateCLpAction::class,
             openapi: new Operation(
@@ -96,7 +97,7 @@
                     ]),
                 ),
             ),
-            security: "is_granted('ROLE_TEACHER') or is_granted('ROLE_ADMIN')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             validationContext: ['groups' => ['lp:write']],
             deserialize: false,
         ),
@@ -129,7 +130,7 @@
                     ]),
                 ),
             ),
-            security: "is_granted('ROLE_TEACHER') or is_granted('ROLE_ADMIN')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             read: false,
             deserialize: false,
             name: 'lp_reorder'

From bd00fbc0614df9ba9656b8e12744438d9c876e1b Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:42:13 -0500
Subject: [PATCH 15/38] Security: StudentPublication: Enforce contextual course
 roles on API operations

Add a contextual read role to the GetCollection (replacing the lax ROLE_USER)
and drop the platform-wide ROLE_TEACHER fallback from the create operation.

The /upload operation (ROLE_STUDENT / ROLE_STUDENT_BOSS) is intentionally left
unchanged: switching it to contextual roles would change who can submit
assignments and affect student-boss supervisors, which needs a separate decision.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CStudentPublication.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/CourseBundle/Entity/CStudentPublication.php b/src/CourseBundle/Entity/CStudentPublication.php
index 2af72f4e2ed..aff8b8f6013 100644
--- a/src/CourseBundle/Entity/CStudentPublication.php
+++ b/src/CourseBundle/Entity/CStudentPublication.php
@@ -65,7 +65,7 @@
                     ),
                 ],
             ),
-            security: "is_granted('ROLE_USER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
             parameters: [
                 'cid' => new QueryParameter(
                     schema: ['type' => 'integer'],
@@ -79,7 +79,7 @@
             processor: CStudentPublicationDeleteProcessor::class
         ),
         new Post(
-            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER') or is_granted('ROLE_TEACHER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             processor: CStudentPublicationPostStateProcessor::class
         ),
         new Post(

From 77e919caba69084443c6c28b2484c616d686e837 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:44:11 -0500
Subject: [PATCH 16/38] Security: StudentPublicationComment: Enforce contextual
 course roles

Replace the lax ROLE_USER on the comment list and upload operations with
contextual course/session read roles. The Delete operation keeps its
owner-only check (object.getUser() == user), which is already stricter.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CStudentPublicationComment.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/CourseBundle/Entity/CStudentPublicationComment.php b/src/CourseBundle/Entity/CStudentPublicationComment.php
index e87e72510d7..6a75405e5d3 100644
--- a/src/CourseBundle/Entity/CStudentPublicationComment.php
+++ b/src/CourseBundle/Entity/CStudentPublicationComment.php
@@ -28,12 +28,12 @@
     operations: [
         new GetCollection(
             uriTemplate: '/c_student_publication_comments',
-            security: "is_granted('ROLE_USER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
         ),
         new Post(
             uriTemplate: '/c_student_publication_comments/upload',
             controller: CreateStudentPublicationCommentAction::class,
-            security: "is_granted('ROLE_USER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
             deserialize: false,
         ),
         new Delete(

From 0c96faf1dd903eab21a4ef89276d2c1fca7782ca Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:45:16 -0500
Subject: [PATCH 17/38] Security: ToolIntro: Enforce contextual read role on
 GetCollection

Replace the lax ROLE_USER on the tool-intro list with contextual course/session
read roles (CidFilter already scopes results to the requested course). Item
operations already use object-level checks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CToolIntro.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/CourseBundle/Entity/CToolIntro.php b/src/CourseBundle/Entity/CToolIntro.php
index f5a15f45fdb..f7bc94fa18a 100644
--- a/src/CourseBundle/Entity/CToolIntro.php
+++ b/src/CourseBundle/Entity/CToolIntro.php
@@ -46,7 +46,7 @@
                     ),
                 ],
             ),
-            security: "is_granted('ROLE_USER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
             parameters: [
                 'cid' => new QueryParameter(
                     schema: ['type' => 'integer'],

From 2a57170faabda6961c9c8aaf3abe5f19ad4a74af Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:46:12 -0500
Subject: [PATCH 18/38] Security: BlogPost: Enforce contextual read role on
 GetCollection

Replace the lax ROLE_USER on the blog-post list with contextual course/session
read roles. Item operations already gate through the parent blog's resource node.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CBlogPost.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/CourseBundle/Entity/CBlogPost.php b/src/CourseBundle/Entity/CBlogPost.php
index 3a7c48435c3..f5de92cd13e 100644
--- a/src/CourseBundle/Entity/CBlogPost.php
+++ b/src/CourseBundle/Entity/CBlogPost.php
@@ -24,7 +24,7 @@
 #[ApiResource(
     operations: [
         new Get(security: "object.getBlog() != null and is_granted('VIEW', object.getBlog().resourceNode)"),
-        new GetCollection(security: "is_granted('ROLE_USER')"),
+        new GetCollection(security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')"),
         new Post(
             securityPostDenormalize: "object.getBlog() != null and is_granted('EDIT', object.getBlog().resourceNode)",
             processor: CBlogAssignAuthorProcessor::class

From c7a2cc5a898843c1af74ed9ac6287bf61c2fdb01 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:46:53 -0500
Subject: [PATCH 19/38] Security: BlogComment: Enforce contextual read role on
 GetCollection

Replace the lax ROLE_USER on the blog-comment list with contextual
course/session read roles. Item operations already gate through the parent
blog/post resource node.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CBlogComment.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/CourseBundle/Entity/CBlogComment.php b/src/CourseBundle/Entity/CBlogComment.php
index d359dafd6b7..84c47769e5f 100644
--- a/src/CourseBundle/Entity/CBlogComment.php
+++ b/src/CourseBundle/Entity/CBlogComment.php
@@ -24,7 +24,7 @@
 #[ApiResource(
     operations: [
         new Get(security: "(object.getBlog() != null and is_granted('VIEW', object.getBlog().resourceNode)) or (object.getPost() != null and object.getPost().getBlog() != null and is_granted('VIEW', object.getPost().getBlog().resourceNode))"),
-        new GetCollection(security: "is_granted('ROLE_USER')"),
+        new GetCollection(security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')"),
         new Post(
             securityPostDenormalize: "(object.getPost() != null and object.getPost().getBlog() != null and is_granted('VIEW', object.getPost().getBlog().resourceNode)) or (object.getBlog() != null and is_granted('VIEW', object.getBlog().resourceNode))",
             processor: CBlogAssignAuthorProcessor::class

From e115396f532570a80e0328f5428cbfa55be0d578 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:48:12 -0500
Subject: [PATCH 20/38] Security: BlogTask: Enforce contextual/object-level
 roles on API operations

Align the blog-task operations with the rest of the blog module: gate item
reads/writes through the parent blog's resource node (plus author ownership for
patch/delete), add a contextual read role to the GetCollection, and require
EDIT on the blog to create a task. Removes the lax ROLE_USER and the
platform-wide ROLE_TEACHER/ROLE_ADMIN fallbacks (admins keep access via the
role hierarchy).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CBlogTask.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/CourseBundle/Entity/CBlogTask.php b/src/CourseBundle/Entity/CBlogTask.php
index 1aa64b34d99..061db218e0a 100644
--- a/src/CourseBundle/Entity/CBlogTask.php
+++ b/src/CourseBundle/Entity/CBlogTask.php
@@ -21,14 +21,14 @@
 #[ORM\Entity]
 #[ApiResource(
     operations: [
-        new Get(security: "is_granted('ROLE_USER')"),
-        new GetCollection(security: "is_granted('ROLE_USER')"),
+        new Get(security: "object.getBlog() != null and is_granted('VIEW', object.getBlog().resourceNode)"),
+        new GetCollection(security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')"),
         new Post(
-            security: "is_granted('ROLE_USER')",
+            securityPostDenormalize: "object.getBlog() != null and is_granted('EDIT', object.getBlog().resourceNode)",
             processor: CBlogAssignAuthorProcessor::class
         ),
-        new Patch(security: "object.getAuthor() === user or is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_TEACHER') or is_granted('ROLE_ADMIN')"),
-        new Delete(security: "object.getAuthor() === user or is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_TEACHER') or is_granted('ROLE_ADMIN')"),
+        new Patch(security: "object.getBlog() != null and (is_granted('EDIT', object.getBlog().resourceNode) or (object.getAuthor() === user and is_granted('VIEW', object.getBlog().resourceNode)))"),
+        new Delete(security: "object.getBlog() != null and (is_granted('DELETE', object.getBlog().resourceNode) or (object.getAuthor() === user and is_granted('VIEW', object.getBlog().resourceNode)))"),
     ],
     normalizationContext: ['groups' => ['blog_task:read']],
     denormalizationContext: ['groups' => ['blog_task:write']]

From 5d670c0f3162029be224a82d879f57fa5653ee24 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:49:40 -0500
Subject: [PATCH 21/38] Security: BlogRelUser: Enforce contextual read role on
 GetCollection

Replace the lax ROLE_USER on the blog-membership list with contextual
course/session read roles. Write operations already gate through the parent
blog's resource node.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CBlogRelUser.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/CourseBundle/Entity/CBlogRelUser.php b/src/CourseBundle/Entity/CBlogRelUser.php
index 42c4e1d89c7..93a6b939bf2 100644
--- a/src/CourseBundle/Entity/CBlogRelUser.php
+++ b/src/CourseBundle/Entity/CBlogRelUser.php
@@ -18,7 +18,7 @@
 
 #[ApiResource(
     operations: [
-        new GetCollection(security: "is_granted('ROLE_USER')"),
+        new GetCollection(security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')"),
         new Post(securityPostDenormalize: "object.getBlog() != null and is_granted('EDIT', object.getBlog().resourceNode)"),
         new Delete(security: "object.getBlog() != null and is_granted('EDIT', object.getBlog().resourceNode)"),
     ],

From d2c7335015a6ff7282cdc534d94a828bbb08e363 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:51:06 -0500
Subject: [PATCH 22/38] Security: BlogAttachment: Enforce
 contextual/object-level roles

Gate item reads and creates through the parent blog's resource node, add a
contextual read role to the GetCollection, and require course membership for
the upload endpoint (was IS_AUTHENTICATED_REMEMBERED). Removes the lax ROLE_USER.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CBlogAttachment.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/CourseBundle/Entity/CBlogAttachment.php b/src/CourseBundle/Entity/CBlogAttachment.php
index e1031394cca..6547961d699 100644
--- a/src/CourseBundle/Entity/CBlogAttachment.php
+++ b/src/CourseBundle/Entity/CBlogAttachment.php
@@ -18,13 +18,13 @@
 #[ORM\Entity]
 #[ApiResource(
     operations: [
-        new Get(security: "is_granted('ROLE_USER')"),
-        new GetCollection(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_USER')"),
+        new Get(security: "object.getBlog() != null and is_granted('VIEW', object.getBlog().resourceNode)"),
+        new GetCollection(security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')"),
+        new Post(securityPostDenormalize: "object.getBlog() != null and is_granted('EDIT', object.getBlog().resourceNode)"),
         new Post(
             uriTemplate: '/c_blog_attachments/upload',
             controller: CreateBlogAttachmentAction::class,
-            security: "is_granted('IS_AUTHENTICATED_REMEMBERED')",
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
             output: false,
             deserialize: false
         ),

From 78870cc6263606d8015d044f3ad0bbae2f8fda69 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:52:57 -0500
Subject: [PATCH 23/38] Security: BlogRating: Enforce contextual read role at
 resource level

Replace the resource-wide ROLE_USER with contextual course/session roles so
ratings can only be listed and submitted by members of the current course.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CBlogRating.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/CourseBundle/Entity/CBlogRating.php b/src/CourseBundle/Entity/CBlogRating.php
index 3485f15a4de..fa561c9b3df 100644
--- a/src/CourseBundle/Entity/CBlogRating.php
+++ b/src/CourseBundle/Entity/CBlogRating.php
@@ -19,7 +19,7 @@
     normalizationContext: ['groups' => ['blog_rating:read']],
     denormalizationContext: ['groups' => ['blog_rating:write']],
     paginationEnabled: true,
-    security: "is_granted('ROLE_USER')",
+    security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
 )]
 #[ApiFilter(SearchFilter::class, properties: [
     'blog' => 'exact',

From 65ddd49696d45c2ace54412fab2adba6904255b8 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:54:01 -0500
Subject: [PATCH 24/38] Security: BlogTaskRelUser: Enforce
 contextual/object-level roles

Gate item reads through the parent blog's resource node, add a contextual read
role to the GetCollection, and replace the platform-wide ROLE_TEACHER/ROLE_ADMIN
fallbacks on create/patch with contextual teacher roles (the patch keeps its
owner check; admins keep access via the role hierarchy).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CBlogTaskRelUser.php | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/src/CourseBundle/Entity/CBlogTaskRelUser.php b/src/CourseBundle/Entity/CBlogTaskRelUser.php
index 79ceaeac6be..0cd8b4da830 100644
--- a/src/CourseBundle/Entity/CBlogTaskRelUser.php
+++ b/src/CourseBundle/Entity/CBlogTaskRelUser.php
@@ -22,14 +22,13 @@
 #[ORM\Entity]
 #[ApiResource(
     operations: [
-        new Get(security: "is_granted('ROLE_USER')"),
-        new GetCollection(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_TEACHER')"),
+        new Get(security: "object.getBlog() != null and is_granted('VIEW', object.getBlog().resourceNode)"),
+        new GetCollection(security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')"),
+        new Post(security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')"),
         new Patch(security: "
             object.getUser() === user
             or is_granted('ROLE_CURRENT_COURSE_TEACHER')
-            or is_granted('ROLE_TEACHER')
-            or is_granted('ROLE_ADMIN')
+            or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')
         "),
     ],
     normalizationContext: ['groups' => ['task_rel_user:read']],

From 23c2ec16b64ae887302eb5612e46386805628c49 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:54:30 -0500
Subject: [PATCH 25/38] Security: StudentPublicationCorrection: Enforce
 contextual teacher roles

Replace the platform-wide ROLE_TEACHER fallback on the correction upload with
contextual course/session teacher roles.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CStudentPublicationCorrection.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/CourseBundle/Entity/CStudentPublicationCorrection.php b/src/CourseBundle/Entity/CStudentPublicationCorrection.php
index c668b95c582..aa412b6c6c4 100644
--- a/src/CourseBundle/Entity/CStudentPublicationCorrection.php
+++ b/src/CourseBundle/Entity/CStudentPublicationCorrection.php
@@ -24,7 +24,7 @@
         new Post(
             uriTemplate: '/c_student_publication_corrections/upload',
             controller: CreateStudentPublicationCorrectionFileAction::class,
-            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_TEACHER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             deserialize: false,
         ),
     ],

From f4876c03ac6af09d7b4127bb3194ef469cd1bd55 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:55:18 -0500
Subject: [PATCH 26/38] Security: StudentPublicationRelDocument: Enforce
 contextual/object-level roles

Gate the item Get through the parent publication's resource node, add a
contextual read role to the GetCollection, and drop the platform-wide
ROLE_TEACHER fallback from create/delete in favour of contextual teacher roles.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../Entity/CStudentPublicationRelDocument.php             | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/CourseBundle/Entity/CStudentPublicationRelDocument.php b/src/CourseBundle/Entity/CStudentPublicationRelDocument.php
index bb517bb2943..91859a64c44 100644
--- a/src/CourseBundle/Entity/CStudentPublicationRelDocument.php
+++ b/src/CourseBundle/Entity/CStudentPublicationRelDocument.php
@@ -18,10 +18,10 @@
 
 #[ApiResource(
     operations: [
-        new Get(security: "is_granted('ROLE_USER')"),
-        new Delete(security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_TEACHER')"),
-        new Post(security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_TEACHER')"),
-        new GetCollection(security: "is_granted('ROLE_USER')"),
+        new Get(security: "object.getPublication() != null and is_granted('VIEW', object.getPublication().resourceNode)"),
+        new Delete(security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')"),
+        new Post(security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')"),
+        new GetCollection(security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')"),
     ],
     normalizationContext: ['groups' => ['student_publication_rel_document:read']],
     denormalizationContext: ['groups' => ['student_publication_rel_document:write']]

From 5ac887336292488f355e20a2823930b6a42536a9 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:56:45 -0500
Subject: [PATCH 27/38] Security: StudentPublicationRelUser: Enforce
 contextual/object-level roles

Gate the item Get through the parent publication's resource node, add a
contextual read role to the GetCollection and resource-level fallback, and
replace the platform-wide ROLE_TEACHER/ROLE_SESSION_MANAGER checks on
create/delete with contextual teacher roles.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CStudentPublicationRelUser.php | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/CourseBundle/Entity/CStudentPublicationRelUser.php b/src/CourseBundle/Entity/CStudentPublicationRelUser.php
index 6d2b765670b..c6d8d91515c 100644
--- a/src/CourseBundle/Entity/CStudentPublicationRelUser.php
+++ b/src/CourseBundle/Entity/CStudentPublicationRelUser.php
@@ -21,14 +21,14 @@
 #[ORM\Entity]
 #[ApiResource(
     operations: [
-        new Get(security: "is_granted('ROLE_USER')"),
-        new GetCollection(security: "is_granted('ROLE_USER')"),
-        new Post(security: "is_granted('ROLE_TEACHER') or is_granted('ROLE_SESSION_MANAGER')"),
-        new Delete(security: "is_granted('ROLE_TEACHER') or is_granted('ROLE_SESSION_MANAGER')"),
+        new Get(security: "object.getPublication() != null and is_granted('VIEW', object.getPublication().resourceNode)"),
+        new GetCollection(security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')"),
+        new Post(security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')"),
+        new Delete(security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')"),
     ],
     normalizationContext: ['groups' => ['student_publication_rel_user:read']],
     denormalizationContext: ['groups' => ['student_publication_rel_user:write']],
-    security: "is_granted('ROLE_USER')"
+    security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')"
 )]
 #[ApiFilter(SearchFilter::class, properties: [
     'publication' => 'exact',

From d802c391ffcee8deaa1082f2022a2fd063e04623 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:57:27 -0500
Subject: [PATCH 28/38] Security: Tool: Enforce contextual read role on
 GetCollection

Add a contextual course/session read role to the course-tools list, which
previously relied on the default ROLE_USER firewall check (CidFilter already
scopes results to the requested course).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CTool.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/CourseBundle/Entity/CTool.php b/src/CourseBundle/Entity/CTool.php
index faf9664563f..cb1bd8af592 100644
--- a/src/CourseBundle/Entity/CTool.php
+++ b/src/CourseBundle/Entity/CTool.php
@@ -34,6 +34,7 @@
         new GetCollection(
             output: CourseTool::class,
             provider: CToolStateProvider::class,
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
         ),
     ],
     normalizationContext: ['groups' => ['ctool:read']],

From 09c93501fa2eee9c685c09cd9c30bec31cebf773 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:58:19 -0500
Subject: [PATCH 29/38] Security: Group: Enforce contextual read role on
 GetCollection

Add a contextual course/session read role to the groups list, which previously
relied on the default ROLE_USER firewall check. The item Get already uses an
object-level VIEW on the resource node.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CGroup.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/CourseBundle/Entity/CGroup.php b/src/CourseBundle/Entity/CGroup.php
index 68b196ce3b0..cb9fa6a10b5 100644
--- a/src/CourseBundle/Entity/CGroup.php
+++ b/src/CourseBundle/Entity/CGroup.php
@@ -40,7 +40,8 @@
                         schema: ['type' => 'integer'],
                     ),
                 ],
-            )
+            ),
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
         ),
         new Get(security: "is_granted('VIEW', object.resourceNode)"),
     ],

From 3160bc15361aaaec41b8132193b21fc9ac2ce7f6 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 00:58:52 -0500
Subject: [PATCH 30/38] Security: DropboxFile: Enforce contextual roles on
 upload

Replace the very lax IS_AUTHENTICATED_REMEMBERED check on the dropbox upload
with contextual course/session roles, so only members of the current course
can share files through the dropbox.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CDropboxFile.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/CourseBundle/Entity/CDropboxFile.php b/src/CourseBundle/Entity/CDropboxFile.php
index d597e8dec68..8c5e68d83c2 100644
--- a/src/CourseBundle/Entity/CDropboxFile.php
+++ b/src/CourseBundle/Entity/CDropboxFile.php
@@ -23,7 +23,7 @@
     new Post(
         uriTemplate: '/c_dropbox_files/upload',
         controller: CreateDropboxFileAction::class,
-        security: "is_granted('IS_AUTHENTICATED_REMEMBERED')",
+        security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
         validationContext: ['groups' => ['Default']],
         output: false,
         deserialize: false

From 61fcfafbb28eddabcd527ca4707fcebaa2876630 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 17:02:20 -0500
Subject: [PATCH 31/38] Security: AttendanceCalendar: Enforce
 contextual/object-level roles

Replace the resource-wide platform ROLE_TEACHER check with explicit operations
gated through the parent attendance's resource node: object-level VIEW for the
item Get, object-level EDIT for create/update/delete, and a contextual teacher
role for the collection. Removes the cross-course IDOR allowed by the plain
ROLE_TEACHER role.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CAttendanceCalendar.php | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/CourseBundle/Entity/CAttendanceCalendar.php b/src/CourseBundle/Entity/CAttendanceCalendar.php
index 5f3fd0ffab2..9fc14aee92c 100644
--- a/src/CourseBundle/Entity/CAttendanceCalendar.php
+++ b/src/CourseBundle/Entity/CAttendanceCalendar.php
@@ -7,16 +7,29 @@
 namespace Chamilo\CourseBundle\Entity;
 
 use ApiPlatform\Metadata\ApiResource;
+use ApiPlatform\Metadata\Delete;
+use ApiPlatform\Metadata\Get;
+use ApiPlatform\Metadata\GetCollection;
+use ApiPlatform\Metadata\Patch;
+use ApiPlatform\Metadata\Post;
+use ApiPlatform\Metadata\Put;
 use DateTime;
 use Doctrine\Common\Collections\Collection;
 use Doctrine\ORM\Mapping as ORM;
 use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
+    operations: [
+        new Get(security: "object.getAttendance() != null and is_granted('VIEW', object.getAttendance().resourceNode)"),
+        new GetCollection(security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')"),
+        new Post(securityPostDenormalize: "object.getAttendance() != null and is_granted('EDIT', object.getAttendance().resourceNode)"),
+        new Put(security: "object.getAttendance() != null and is_granted('EDIT', object.getAttendance().resourceNode)"),
+        new Patch(security: "object.getAttendance() != null and is_granted('EDIT', object.getAttendance().resourceNode)"),
+        new Delete(security: "object.getAttendance() != null and is_granted('EDIT', object.getAttendance().resourceNode)"),
+    ],
     normalizationContext: ['groups' => ['attendance_calendar:read']],
     denormalizationContext: ['groups' => ['attendance_calendar:write']],
     paginationEnabled: false,
-    security: "is_granted('ROLE_TEACHER')"
 )]
 #[ORM\Table(name: 'c_attendance_calendar')]
 #[ORM\Index(columns: ['done_attendance'], name: 'done_attendance')]

From 4c5f54f17069c9a6d89d6af50210e5ccb69a44a8 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 17:10:00 -0500
Subject: [PATCH 32/38] Security: Document: Drop platform ROLE_TEACHER fallback
 from create
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove the platform-wide ROLE_TEACHER fallback from the document create
operation, leaving only the contextual course/session teacher roles — aligning
it with the rest of the migrated CourseBundle resources. The controller already
validates that resourceLinkList entries match the request's course context.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CDocument.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/CourseBundle/Entity/CDocument.php b/src/CourseBundle/Entity/CDocument.php
index d50099d3abb..ca28276868e 100644
--- a/src/CourseBundle/Entity/CDocument.php
+++ b/src/CourseBundle/Entity/CDocument.php
@@ -161,7 +161,7 @@
                     ]),
                 ),
             ),
-            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER') or is_granted('ROLE_TEACHER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             validationContext: ['groups' => ['Default', 'media_object_create', 'document:write']],
             deserialize: false
         ),

From 3e73c9db23d298c212ce98b8918dfa743a6a54cf Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sat, 30 May 2026 17:12:59 -0500
Subject: [PATCH 33/38] Security: Document: Enforce contextual read role on
 usage endpoint

Replace the lax ROLE_USER on GET /documents/{cid}/usage with contextual
course/session read roles. The cid path parameter is read by CidReqListener
(via request attributes), so the contextual roles are published for that course.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/CourseBundle/Entity/CDocument.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/CourseBundle/Entity/CDocument.php b/src/CourseBundle/Entity/CDocument.php
index ca28276868e..514ef233f9f 100644
--- a/src/CourseBundle/Entity/CDocument.php
+++ b/src/CourseBundle/Entity/CDocument.php
@@ -269,7 +269,7 @@
             openapiContext: [
                 'summary' => 'Get usage/quota information for documents.',
             ],
-            security: "is_granted('ROLE_USER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
             read: false,
             name: 'api_documents_usage'
         ),

From 26c7da99e7766bea42fc289ac8dca3673b017310 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Sun, 31 May 2026 01:47:58 -0500
Subject: [PATCH 34/38] Ensure resource link list are derived from the
 session-resolved course context, ignoring body-provided cid/sid/gid values to
 prevent IDOR vulnerabilities. Removes redundant manual checks for context
 mismatches.

---
 assets/vue/views/blog/BlogAdmin.vue           |  8 +-
 .../vue/views/documents/DocumentsUpload.vue   | 46 ++++------
 .../Controller/Api/BaseResourceFileAction.php | 92 ++++++++++++++++++-
 .../Controller/Api/CreateCBlogAction.php      | 59 ++----------
 .../Api/CreateDocumentFileAction.php          | 86 +++--------------
 5 files changed, 133 insertions(+), 158 deletions(-)

diff --git a/assets/vue/views/blog/BlogAdmin.vue b/assets/vue/views/blog/BlogAdmin.vue
index 82b5ef5b118..ec5c334f774 100644
--- a/assets/vue/views/blog/BlogAdmin.vue
+++ b/assets/vue/views/blog/BlogAdmin.vue
@@ -172,11 +172,9 @@ import ProjectCreateDialog from "../../components/blog/ProjectCreateDialog.vue"
 import service from "../../services/blogs"
 import { useSecurityStore } from "../../store/securityStore"
 import { RESOURCE_LINK_DRAFT } from "../../constants/entity/resourcelink"
-import { getCourseContext } from "../../utils/courseContext"
 import SectionHeader from "../../components/layout/SectionHeader.vue"
 import BaseCheckbox from "../../components/basecomponents/BaseCheckbox.vue"
 
-const { cid, sid } = getCourseContext()
 const { t } = useI18n()
 const route = useRoute()
 
@@ -184,9 +182,11 @@ const route = useRoute()
 const securityStore = useSecurityStore()
 const isAdminOrTeacher = computed(() => securityStore.isAdmin || securityStore.isTeacher)
 
-// Parent node and default link list (created as draft)
+// Parent node and default link list (created as draft). The course context
+// (cid/sid/gid) is derived server-side from the gated session course, so the
+// link list only carries the visibility.
 const parentResourceNodeId = ref(Number(route.params.node))
-const resourceLinkList = ref([{ sid, cid, visibility: RESOURCE_LINK_DRAFT }])
+const resourceLinkList = ref([{ visibility: RESOURCE_LINK_DRAFT }])
 
 // UI state
 const q = ref("")
diff --git a/assets/vue/views/documents/DocumentsUpload.vue b/assets/vue/views/documents/DocumentsUpload.vue
index ae666ecdf90..d57475732b2 100644
--- a/assets/vue/views/documents/DocumentsUpload.vue
+++ b/assets/vue/views/documents/DocumentsUpload.vue
@@ -221,7 +221,7 @@
 </template>
 
 <script setup>
-import { computed, ref, watch, onBeforeUnmount, onMounted, unref } from "vue"
+import { computed, ref, watch, onBeforeUnmount, onMounted } from "vue"
 import "@uppy/core/dist/style.css"
 import "@uppy/dashboard/dist/style.css"
 import "@uppy/image-editor/dist/style.css"
@@ -348,11 +348,6 @@ const quotaInfo = ref({
   fetchedAt: 0,
 })
 
-function toInt(value, fallback = 0) {
-  const n = Number(unref(value))
-  return Number.isFinite(n) ? n : fallback
-}
-
 function normalizeCode(code) {
   return String(code || "")
     .trim()
@@ -408,7 +403,7 @@ async function applyDefaultLanguageFromCourse() {
     return
   }
 
-  const courseId = toInt(cid, 0)
+  const courseId = cid
   if (!courseId) {
     return
   }
@@ -445,26 +440,14 @@ function buildSearchFieldMeta(values, fields) {
   return meta
 }
 
+// The course context (cid/sid/gid) is derived server-side from the gated
+// session course, so the link list only needs to carry the visibility.
 function buildResourceLinkList() {
-  return JSON.stringify([
-    {
-      gid: toInt(gid, 0),
-      sid: toInt(sid, 0),
-      cid: toInt(cid, 0),
-      visibility: RESOURCE_LINK_PUBLISHED,
-    },
-  ])
+  return JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }])
 }
 
 function buildResourceLinkArray() {
-  return [
-    {
-      gid: toInt(gid, 0),
-      sid: toInt(sid, 0),
-      cid: toInt(cid, 0),
-      visibility: RESOURCE_LINK_PUBLISHED,
-    },
-  ]
+  return [{ visibility: RESOURCE_LINK_PUBLISHED }]
 }
 
 async function saveCloudLink() {
@@ -532,12 +515,12 @@ async function saveCloudLink() {
  * Refresh quota info using documentsService cache and update the banner.
  */
 async function refreshQuota(force = false) {
-  const courseId = toInt(cid, 0)
+  const courseId = cid
   if (!courseId) return null
 
   const info = await documentsService.getQuotaUsage(courseId, {
-    sid: toInt(sid, 0),
-    gid: toInt(gid, 0),
+    sid,
+    gid,
     force,
     staleMs: QUOTA_STALE_MS,
   })
@@ -615,7 +598,10 @@ const uppy = new Uppy({ autoProceed: false })
     },
   })
   .use(XHRUpload, {
-    endpoint: "/api/documents",
+    // Uppy issues a raw XHR that bypasses the axios interceptor, so the course
+    // context must be appended to the URL explicitly. The backend reads it to
+    // gate the upload and to bind the document to the current course.
+    endpoint: `/api/documents?cid=${cid}&sid=${sid}&gid=${gid}`,
     formData: true,
     fieldName: "uploadFile",
     getResponseError: (responseText, xhr) => {
@@ -758,9 +744,9 @@ watch(
 function back() {
   const queryParams = {
     ...buildReturnQuery(),
-    cid: toInt(cid, 0),
-    sid: toInt(sid, 0),
-    gid: toInt(gid, 0),
+    cid,
+    sid,
+    gid,
     tab: route.query.tab,
   }
 
diff --git a/src/CoreBundle/Controller/Api/BaseResourceFileAction.php b/src/CoreBundle/Controller/Api/BaseResourceFileAction.php
index 0cf1af44923..4eb158f7ad9 100644
--- a/src/CoreBundle/Controller/Api/BaseResourceFileAction.php
+++ b/src/CoreBundle/Controller/Api/BaseResourceFileAction.php
@@ -160,6 +160,78 @@ public static function setLinks(AbstractResource $resource, EntityManagerInterfa
         }
     }
 
+    /**
+     * Builds the canonical resource link list from the request course context.
+     *
+     * The course/session/group that gate the operation's `security:` expression
+     * are resolved by CidReqListener and stored in the session (the contextual
+     * ROLE_CURRENT_COURSE_* roles are computed from there). That session context
+     * is therefore the single source of truth for the link binding, so we ignore
+     * any cid/sid/gid sent in the request body and only keep the caller-provided
+     * visibility. This closes the IDOR where the body could target a foreign
+     * course regardless of the gated context.
+     *
+     * @param array<int, mixed> $bodyResourceLinkList resource link entries parsed from the request body
+     *
+     * @return array<int, array<string, int>> a single link bound to the current course context
+     */
+    protected function buildResourceLinkListFromContext(
+        Request $request,
+        array $bodyResourceLinkList,
+        int $defaultVisibility = ResourceLink::VISIBILITY_PUBLISHED
+    ): array {
+        $cid = 0;
+        $sid = 0;
+        $gid = 0;
+
+        if ($request->hasSession()) {
+            $session = $request->getSession();
+
+            $course = $session->get('course');
+            if ($course instanceof Course) {
+                $cid = (int) $course->getId();
+            }
+
+            $courseSession = $session->get('session');
+            if ($courseSession instanceof Session) {
+                $sid = (int) $courseSession->getId();
+            }
+
+            $group = $session->get('group');
+            if ($group instanceof CGroup) {
+                $gid = (int) $group->getIid();
+            }
+        }
+
+        // Fallback to the query parameters (kept in sync with the session by
+        // CidReqListener) in the unlikely case the session context is missing.
+        if ($cid <= 0) {
+            $cid = $request->query->getInt('cid');
+            $sid = $request->query->getInt('sid');
+            $gid = $request->query->getInt('gid');
+        }
+
+        // Visibility is the only field still honored from the body.
+        $visibility = $defaultVisibility;
+        $first = $bodyResourceLinkList[0] ?? null;
+        if (\is_array($first) && isset($first['visibility'])) {
+            $visibility = (int) $first['visibility'];
+        }
+
+        $link = ['visibility' => $visibility];
+        if ($cid > 0) {
+            $link['cid'] = $cid;
+        }
+        if ($sid > 0) {
+            $link['sid'] = $sid;
+        }
+        if ($gid > 0) {
+            $link['gid'] = $gid;
+        }
+
+        return [$link];
+    }
+
     /**
      * @todo use this function inside handleCreateFileRequest
      */
@@ -257,7 +329,8 @@ public function handleCreateFileRequest(
         string $fileExistsOption = '',
         ?TranslatorInterface $translator = null,
         ?CourseRepository $courseRepository = null,
-        ?CourseHelper $courseHelper = null
+        ?CourseHelper $courseHelper = null,
+        ?array $resourceLinkListOverride = null
     ): array {
         $contentData = $request->getContent();
 
@@ -289,6 +362,12 @@ public function handleCreateFileRequest(
             }
         }
 
+        // The controller may force the link context (cid/sid/gid) from the
+        // session-resolved course, ignoring whatever the body sent.
+        if (null !== $resourceLinkListOverride) {
+            $resourceLinkList = $resourceLinkListOverride;
+        }
+
         if (empty($fileType)) {
             throw new Exception('filetype needed: folder or file');
         }
@@ -473,7 +552,8 @@ protected function handleCreateFileRequestUncompress(
         KernelInterface $kernel,
         ?CourseRepository $courseRepository = null,
         ?CDocumentRepository $documentRepository = null,
-        ?CourseHelper $courseHelper = null
+        ?CourseHelper $courseHelper = null,
+        ?array $resourceLinkListOverride = null
     ): array {
         $rawParent = $request->get('parentResourceNodeId');
         $parentResourceNodeId = (int) ($this->normalizeNodeId($rawParent) ?? 0);
@@ -494,6 +574,12 @@ protected function handleCreateFileRequestUncompress(
             }
         }
 
+        // The controller may force the link context (cid/sid/gid) from the
+        // session-resolved course, ignoring whatever the body sent.
+        if (null !== $resourceLinkListOverride) {
+            $resourceLinkList = $resourceLinkListOverride;
+        }
+
         if (empty($fileType)) {
             throw new Exception('filetype needed: folder or file');
         }
@@ -1008,7 +1094,7 @@ private function resolveCourseIdFromRequest(Request $request): int
         return 0;
     }
 
-    private function extractResourceLinkListFromRequest(Request $request): array
+    protected function extractResourceLinkListFromRequest(Request $request): array
     {
         $raw = $request->request->get('resourceLinkList', null);
 
diff --git a/src/CoreBundle/Controller/Api/CreateCBlogAction.php b/src/CoreBundle/Controller/Api/CreateCBlogAction.php
index 6300027fc6d..bf088c0db45 100644
--- a/src/CoreBundle/Controller/Api/CreateCBlogAction.php
+++ b/src/CoreBundle/Controller/Api/CreateCBlogAction.php
@@ -7,6 +7,7 @@
 namespace Chamilo\CoreBundle\Controller\Api;
 
 use Chamilo\CoreBundle\Entity\Course;
+use Chamilo\CoreBundle\Entity\ResourceLink;
 use Chamilo\CoreBundle\Entity\Session;
 use Chamilo\CoreBundle\Entity\User;
 use Chamilo\CourseBundle\Entity\CBlog;
@@ -16,7 +17,6 @@
 use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Attribute\AsController;
-use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 
 #[AsController]
 class CreateCBlogAction extends BaseResourceFileAction
@@ -43,11 +43,15 @@ public function __invoke(
             $resourceLinkList = \is_array($resourceLinkListRaw) ? $resourceLinkListRaw : [];
         }
 
-        // The `cid` (and optional `sid`/`gid`) query parameter establishes the
-        // course context that gated the security expression. Any
-        // resourceLinkList entry that points to a different context would
-        // bypass that gate, so we reject the request outright.
-        $this->assertResourceLinkListMatchesQueryContext($request, $resourceLinkList, $security);
+        // The link context (cid/sid/gid) is taken from the session-resolved
+        // course that gated this operation, not from the request body. This
+        // makes it impossible for the body to target a foreign course (IDOR):
+        // the body is only allowed to carry the link visibility.
+        $resourceLinkList = $this->buildResourceLinkListFromContext(
+            $request,
+            $resourceLinkList,
+            ResourceLink::VISIBILITY_DRAFT
+        );
 
         $blog = (new CBlog())
             ->setTitle($title)
@@ -96,47 +100,4 @@ private function handleShortcutCreation(
             $shortcutRepository->addShortCut($blog, $currentUser, $course, $session);
         }
     }
-
-    /**
-     * @param array<int, mixed> $resourceLinkList
-     */
-    private function assertResourceLinkListMatchesQueryContext(
-        Request $request,
-        array $resourceLinkList,
-        Security $security,
-    ): void {
-        if ($security->isGranted('ROLE_ADMIN')) {
-            return;
-        }
-
-        if ([] === $resourceLinkList) {
-            return;
-        }
-
-        $queryCid = (int) $request->query->get('cid');
-        $querySid = (int) $request->query->get('sid');
-        $queryGid = (int) $request->query->get('gid');
-
-        foreach ($resourceLinkList as $entry) {
-            if (!\is_array($entry)) {
-                continue;
-            }
-
-            $entryCid = (int) ($entry['cid'] ?? 0);
-            $entrySid = (int) ($entry['sid'] ?? 0);
-            $entryGid = (int) ($entry['gid'] ?? 0);
-
-            if ($entryCid > 0 && $entryCid !== $queryCid) {
-                throw new AccessDeniedHttpException('resourceLinkList course does not match the request context.');
-            }
-
-            if ($entrySid > 0 && $entrySid !== $querySid) {
-                throw new AccessDeniedHttpException('resourceLinkList session does not match the request context.');
-            }
-
-            if ($entryGid > 0 && $entryGid !== $queryGid) {
-                throw new AccessDeniedHttpException('resourceLinkList group does not match the request context.');
-            }
-        }
-    }
 }
diff --git a/src/CoreBundle/Controller/Api/CreateDocumentFileAction.php b/src/CoreBundle/Controller/Api/CreateDocumentFileAction.php
index d3f56dea9ef..d9c65917d50 100644
--- a/src/CoreBundle/Controller/Api/CreateDocumentFileAction.php
+++ b/src/CoreBundle/Controller/Api/CreateDocumentFileAction.php
@@ -6,16 +6,14 @@
 
 namespace Chamilo\CoreBundle\Controller\Api;
 
-use Chamilo\CoreBundle\Entity\User;
+use Chamilo\CoreBundle\Entity\ResourceLink;
 use Chamilo\CoreBundle\Helpers\AiDisclosureHelper;
 use Chamilo\CoreBundle\Helpers\CourseHelper;
 use Chamilo\CoreBundle\Repository\Node\CourseRepository;
 use Chamilo\CourseBundle\Entity\CDocument;
 use Chamilo\CourseBundle\Repository\CDocumentRepository;
 use Doctrine\ORM\EntityManager;
-use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\Request;
-use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 use Symfony\Component\HttpKernel\KernelInterface;
 use Symfony\Contracts\Translation\TranslatorInterface;
@@ -51,13 +49,16 @@ public function __invoke(
         CourseRepository $courseRepository,
         CourseHelper $courseHelper,
         AiDisclosureHelper $aiDisclosureHelper,
-        Security $security,
     ): CDocument {
-        // Reject any resourceLinkList entry pointing to a course where the
-        // caller is not a teacher (admins bypass). The operation-level
-        // security expression only validates the role for the query `cid`,
-        // so the body could otherwise target a foreign course (IDOR).
-        $this->assertUserCanLinkToCourses($request, $security, $courseRepository);
+        // The link context (cid/sid/gid) is taken from the session-resolved
+        // course that gated this operation, not from the request body. This
+        // makes it impossible for the body to target a foreign course (IDOR):
+        // the body is only allowed to carry the link visibility.
+        $resourceLinkList = $this->buildResourceLinkListFromContext(
+            $request,
+            $this->extractResourceLinkListFromRequest($request),
+            ResourceLink::VISIBILITY_PUBLISHED
+        );
 
         $isUncompressZipEnabled = (string) $request->get('isUncompressZipEnabled', 'false');
         $fileExistsOption = (string) $request->get('fileExistsOption', 'rename');
@@ -74,7 +75,8 @@ public function __invoke(
                 $kernel,
                 $courseRepository,
                 $repo,
-                $courseHelper
+                $courseHelper,
+                $resourceLinkList
             );
         } else {
             $result = $this->handleCreateFileRequest(
@@ -85,7 +87,8 @@ public function __invoke(
                 $fileExistsOption,
                 $translator,
                 $courseRepository,
-                $courseHelper
+                $courseHelper,
+                $resourceLinkList
             );
         }
 
@@ -163,65 +166,4 @@ private function isAllowedCloudLinkHost(string $host): bool
 
         return false;
     }
-
-    private function assertUserCanLinkToCourses(
-        Request $request,
-        Security $security,
-        CourseRepository $courseRepository,
-    ): void {
-        $user = $security->getUser();
-        if (!$user instanceof User) {
-            throw new AccessDeniedHttpException('Authentication required.');
-        }
-
-        if ($security->isGranted('ROLE_ADMIN')) {
-            return;
-        }
-
-        $resourceLinkList = $this->extractResourceLinkList($request);
-        foreach ($resourceLinkList as $entry) {
-            if (!\is_array($entry)) {
-                continue;
-            }
-
-            $cid = (int) ($entry['cid'] ?? 0);
-            if ($cid <= 0) {
-                continue;
-            }
-
-            $course = $courseRepository->find($cid);
-            if (null === $course || !$course->hasUserAsTeacher($user)) {
-                throw new AccessDeniedHttpException('You are not a teacher of one of the referenced courses.');
-            }
-        }
-    }
-
-    /**
-     * @return array<int, mixed>
-     */
-    private function extractResourceLinkList(Request $request): array
-    {
-        $raw = (string) $request->getContent();
-        if ('' !== $raw) {
-            $decoded = json_decode($raw, true);
-            if (\is_array($decoded) && isset($decoded['resourceLinkList']) && \is_array($decoded['resourceLinkList'])) {
-                return $decoded['resourceLinkList'];
-            }
-        }
-
-        $fromForm = $request->get('resourceLinkList', []);
-        if (\is_array($fromForm)) {
-            return $fromForm;
-        }
-
-        if (\is_string($fromForm) && '' !== $fromForm) {
-            $normalized = str_contains($fromForm, '[') ? $fromForm : '['.$fromForm.']';
-            $decoded = json_decode($normalized, true);
-            if (\is_array($decoded)) {
-                return $decoded;
-            }
-        }
-
-        return [];
-    }
 }

From 311e54053337e1d6761d02cd6d0fe0b3a9e2f242 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Mon, 1 Jun 2026 10:01:16 -0500
Subject: [PATCH 35/38] Ensure resource link lists are strictly derived from
 the session-resolved course context, removing all body-provided cid/sid/gid

---
 .../assignments/AssignmentsForm.vue           |  5 +-
 .../components/attendance/AttendanceForm.vue  |  9 +--
 .../components/course/CourseIntroduction.vue  |  9 +--
 .../documents/DocumentAiMediaDialog.vue       |  3 +-
 .../documents/DocumentAudioRecorder.vue       | 10 +--
 .../vue/components/glossary/GlossaryForm.vue  | 13 +---
 .../glossary/GlossaryImportForm.vue           | 13 +---
 .../vue/components/links/LinkCategoryForm.vue | 11 +--
 assets/vue/components/links/LinkForm.vue      | 13 +---
 assets/vue/composables/useFileManager.js      |  5 +-
 .../views/assignments/AssignmentSubmit.vue    |  4 +-
 .../ccalendarevent/CCalendarEventCreate.vue   | 14 +---
 .../ccalendarevent/CCalendarEventList.vue     | 15 +---
 assets/vue/views/ctoolintro/Create.vue        |  9 +--
 assets/vue/views/ctoolintro/Update.vue        | 11 +--
 assets/vue/views/documents/Create.vue         | 11 +--
 assets/vue/views/documents/CreateFile.vue     | 11 +--
 .../views/documents/DocumentForHtmlEditor.vue | 32 +-------
 .../documents/DocumentsGenerateMedia.vue      |  3 +-
 assets/vue/views/documents/DocumentsList.vue  | 10 +--
 assets/vue/views/documents/SvgEditor.vue      | 10 +--
 .../views/glossary/GlossaryGenerateTerms.vue  | 14 +---
 assets/vue/views/glossary/GlossaryList.vue    | 11 +--
 .../Entity/Listener/ResourceListener.php      | 77 +++++++++++++++++++
 24 files changed, 130 insertions(+), 193 deletions(-)

diff --git a/assets/vue/components/assignments/AssignmentsForm.vue b/assets/vue/components/assignments/AssignmentsForm.vue
index c8acc70aebe..03dc04eb5df 100644
--- a/assets/vue/components/assignments/AssignmentsForm.vue
+++ b/assets/vue/components/assignments/AssignmentsForm.vue
@@ -159,7 +159,6 @@ import useVuelidate from "@vuelidate/core"
 import { computed, reactive, ref, watchEffect } from "vue"
 import { maxValue, minValue, required } from "@vuelidate/validators"
 import { useI18n } from "vue-i18n"
-import { getCourseContext } from "../../utils/courseContext"
 import { useRoute } from "vue-router"
 import { RESOURCE_LINK_PUBLISHED } from "../../constants/entity/resourcelink"
 
@@ -177,7 +176,6 @@ const props = defineProps({
 const emit = defineEmits(["submit"])
 
 const { t } = useI18n()
-const { cid, sid, gid } = getCourseContext()
 const route = useRoute()
 
 const showAdvancedSettings = ref(false)
@@ -333,7 +331,8 @@ async function onSubmit() {
     title: assignment.title,
     description: assignment.description,
     parentResourceNode: Number(route.params.node),
-    resourceLinkList: [{ cid, sid, gid, visibility: RESOURCE_LINK_PUBLISHED }],
+    // Course context derived server-side from the gated session course.
+    resourceLinkList: [{ visibility: RESOURCE_LINK_PUBLISHED }],
     qualification: assignment.qualification,
     addToCalendar: assignment.addToCalendar,
     allowTextAssignment: assignment.allowTextAssignment,
diff --git a/assets/vue/components/attendance/AttendanceForm.vue b/assets/vue/components/attendance/AttendanceForm.vue
index c7e8dca5e79..1f25d4c414e 100644
--- a/assets/vue/components/attendance/AttendanceForm.vue
+++ b/assets/vue/components/attendance/AttendanceForm.vue
@@ -126,13 +126,8 @@ const props = defineProps({
 })
 
 const parentResourceNodeId = ref(Number(route.params.node))
-const resourceLinkList = ref([
-  {
-    sid,
-    cid,
-    visibility: RESOURCE_LINK_PUBLISHED,
-  },
-])
+// Course context derived server-side from the gated session course.
+const resourceLinkList = ref([{ visibility: RESOURCE_LINK_PUBLISHED }])
 
 const formData = reactive({
   id: null,
diff --git a/assets/vue/components/course/CourseIntroduction.vue b/assets/vue/components/course/CourseIntroduction.vue
index 87367ecb973..49df390fb30 100644
--- a/assets/vue/components/course/CourseIntroduction.vue
+++ b/assets/vue/components/course/CourseIntroduction.vue
@@ -151,13 +151,8 @@ async function createEmptyIntroIfNeeded() {
     tool: props.tool,
     introText: intro.value?.introText || "",
     sid: currentSessionId.value || 0,
-    resourceLinkList: [
-      {
-        sid: currentSessionId.value || 0,
-        cid: course.value.id,
-        visibility: "published",
-      },
-    ],
+    // Course context derived server-side from the gated session course.
+    resourceLinkList: [{ visibility: "published" }],
   })
 
   intro.value = normalizeIntroResponse(response)
diff --git a/assets/vue/components/documents/DocumentAiMediaDialog.vue b/assets/vue/components/documents/DocumentAiMediaDialog.vue
index 1ada23dfc2e..6789d0c6b46 100644
--- a/assets/vue/components/documents/DocumentAiMediaDialog.vue
+++ b/assets/vue/components/documents/DocumentAiMediaDialog.vue
@@ -570,8 +570,9 @@ function base64ToFile(base64, filename, mime) {
   return new File([blob], filename, { type: mime })
 }
 
+// Course context derived server-side from the gated session course.
 function buildResourceLinkList() {
-  return JSON.stringify([{ gid, sid, cid, visibility: RESOURCE_LINK_PUBLISHED }])
+  return JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }])
 }
 
 function canvasMimeFromContentType(contentType) {
diff --git a/assets/vue/components/documents/DocumentAudioRecorder.vue b/assets/vue/components/documents/DocumentAudioRecorder.vue
index 24072e710f2..6e3debb0ef4 100644
--- a/assets/vue/components/documents/DocumentAudioRecorder.vue
+++ b/assets/vue/components/documents/DocumentAudioRecorder.vue
@@ -55,11 +55,9 @@ import BaseInputText from "../basecomponents/BaseInputText.vue"
 import AudioRecorder from "../AudioRecorder.vue"
 import BaseButton from "../basecomponents/BaseButton.vue"
 import { RESOURCE_LINK_PUBLISHED } from "../../constants/entity/resourcelink"
-import { getCourseContext } from "../../utils/courseContext"
 import documentsService from "../../services/documents"
 
 const { t } = useI18n()
-const queryParams = getCourseContext()
 
 const props = defineProps({
   parentResourceNodeId: {
@@ -101,12 +99,8 @@ const saveAudio = async () => {
     filetype: "file",
     uploadFile: uploadFile,
     parentResourceNodeId: props.parentResourceNodeId,
-    resourceLinkList: JSON.stringify([
-      {
-        ...queryParams,
-        visibility: RESOURCE_LINK_PUBLISHED,
-      },
-    ]),
+    // Course context derived server-side from the gated session course.
+    resourceLinkList: JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }]),
   }
 
   try {
diff --git a/assets/vue/components/glossary/GlossaryForm.vue b/assets/vue/components/glossary/GlossaryForm.vue
index 45a9f6558ed..b446b2eaec1 100644
--- a/assets/vue/components/glossary/GlossaryForm.vue
+++ b/assets/vue/components/glossary/GlossaryForm.vue
@@ -72,7 +72,6 @@ import BaseAdvancedSettingsButton from "../basecomponents/BaseAdvancedSettingsBu
 import ResourceLanguageSelector from "../resources/ResourceLanguageSelector.vue"
 import { useNotification } from "../../composables/notification"
 import glossaryService from "../../services/glossaryService"
-import { getCourseContext } from "../../utils/courseContext"
 import { useSecurityStore } from "../../store/securityStore"
 import { useIsAllowedToEdit } from "../../composables/userPermissions"
 
@@ -80,7 +79,6 @@ const route = useRoute()
 const router = useRouter()
 const { t } = useI18n()
 const notification = useNotification()
-const { sid, cid } = getCourseContext()
 const securityStore = useSecurityStore()
 
 const props = defineProps({
@@ -95,15 +93,8 @@ const emit = defineEmits(["backPressed"])
 const parentResourceNodeId = ref(Number(route.params.node))
 const showAdvancedSettings = ref(false)
 
-const resourceLinkList = ref(
-  JSON.stringify([
-    {
-      sid,
-      cid,
-      visibility: RESOURCE_LINK_PUBLISHED, // visible by default
-    },
-  ]),
-)
+// Course context derived server-side from the gated session course.
+const resourceLinkList = ref(JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }]))
 
 const { isAllowedToEdit } = useIsAllowedToEdit({ tutor: true, coach: true, sessionCoach: true })
 
diff --git a/assets/vue/components/glossary/GlossaryImportForm.vue b/assets/vue/components/glossary/GlossaryImportForm.vue
index 18aa26e7f99..13d01d6fca7 100644
--- a/assets/vue/components/glossary/GlossaryImportForm.vue
+++ b/assets/vue/components/glossary/GlossaryImportForm.vue
@@ -60,13 +60,11 @@ import BaseRadioButtons from "../basecomponents/BaseRadioButtons.vue"
 import BaseCheckbox from "../basecomponents/BaseCheckbox.vue"
 import glossaryService from "../../services/glossaryService"
 import BaseFileUpload from "../basecomponents/BaseFileUpload.vue"
-import { getCourseContext } from "../../utils/courseContext"
 
 const route = useRoute()
 const router = useRouter()
 const { t } = useI18n()
 const notification = useNotification()
-const { sid, cid } = getCourseContext()
 
 const emit = defineEmits(["backPressed"])
 
@@ -81,15 +79,8 @@ const replace = ref(false)
 const update = ref(false)
 const parentResourceNodeId = ref(Number(route.params.node))
 
-const resourceLinkList = ref(
-  JSON.stringify([
-    {
-      sid,
-      cid,
-      visibility: RESOURCE_LINK_PUBLISHED, // visible by default
-    },
-  ]),
-)
+// Course context derived server-side from the gated session course.
+const resourceLinkList = ref(JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }]))
 
 const submitForm = async () => {
   console.log(selectedFile.value)
diff --git a/assets/vue/components/links/LinkCategoryForm.vue b/assets/vue/components/links/LinkCategoryForm.vue
index bdb7e8e7d6c..591542cf6fd 100644
--- a/assets/vue/components/links/LinkCategoryForm.vue
+++ b/assets/vue/components/links/LinkCategoryForm.vue
@@ -57,15 +57,8 @@ const props = defineProps({
 const emit = defineEmits(["backPressed"])
 
 const parentResourceNodeId = ref(Number(route.params.node))
-const resourceLinkList = ref(
-  JSON.stringify([
-    {
-      sid: route.query.sid,
-      cid: route.query.cid,
-      visibility: RESOURCE_LINK_PUBLISHED, // visible by default
-    },
-  ]),
-)
+// Course context derived server-side from the gated session course.
+const resourceLinkList = ref(JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }]))
 
 const formData = reactive({
   title: "",
diff --git a/assets/vue/components/links/LinkForm.vue b/assets/vue/components/links/LinkForm.vue
index 33500c58310..a4d8784de9b 100644
--- a/assets/vue/components/links/LinkForm.vue
+++ b/assets/vue/components/links/LinkForm.vue
@@ -117,7 +117,6 @@ import linkService from "../../services/linkService"
 import { useRoute, useRouter } from "vue-router"
 import { useI18n } from "vue-i18n"
 import { computed, onMounted, reactive, ref, watch } from "vue"
-import { getCourseContext } from "../../utils/courseContext"
 import BaseButton from "../basecomponents/BaseButton.vue"
 import { required, url } from "@vuelidate/validators"
 import useVuelidate from "@vuelidate/core"
@@ -138,7 +137,6 @@ import { Dashboard } from "@uppy/vue"
 
 const notification = useNotification()
 const { t } = useI18n()
-const { cid, sid } = getCourseContext()
 const router = useRouter()
 const route = useRoute()
 const selectedFile = ref(null)
@@ -210,15 +208,8 @@ const props = defineProps({
 const emit = defineEmits(["backPressed"])
 
 const parentResourceNodeId = ref(Number(route.params.node))
-const resourceLinkList = ref(
-  JSON.stringify([
-    {
-      sid,
-      cid,
-      visibility: RESOURCE_LINK_PUBLISHED,
-    },
-  ]),
-)
+// Course context derived server-side from the gated session course.
+const resourceLinkList = ref(JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }]))
 const categories = ref([])
 
 const formData = reactive({
diff --git a/assets/vue/composables/useFileManager.js b/assets/vue/composables/useFileManager.js
index 8f96a70aa15..d850ad35500 100644
--- a/assets/vue/composables/useFileManager.js
+++ b/assets/vue/composables/useFileManager.js
@@ -4,7 +4,6 @@ import { useStore } from "vuex"
 import { storeToRefs } from "pinia"
 import { useI18n } from "vue-i18n"
 import { useSecurityStore } from "../store/securityStore"
-import { getCourseContext } from "../utils/courseContext"
 import { RESOURCE_LINK_PUBLISHED } from "../constants/entity/resourcelink"
 import { useCidReqStore } from "../store/cidReq"
 import documentsService from "../services/documents"
@@ -39,7 +38,6 @@ export function useFileManager(entity, apiEndpoint, uploadRoute, isCourseDocumen
   const contextMenuFile = ref(null)
   const previousFolders = ref([])
   const currentFolderTitle = ref("Root")
-  const { cid, sid, gid } = getCourseContext()
 
   // ---- Picker type filter (files/images/media) ----
   const filterType = computed(() => {
@@ -315,7 +313,8 @@ export function useFileManager(entity, apiEndpoint, uploadRoute, isCourseDocumen
       if (!item.value.id) {
         item.value.filetype = "folder"
         item.value.parentResourceNodeId = filters.value["resourceNode.parent"]
-        item.value.resourceLinkList = JSON.stringify([{ gid, sid, cid, visibility: RESOURCE_LINK_PUBLISHED }])
+        // Course context derived server-side from the gated session course.
+        item.value.resourceLinkList = JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }])
 
         try {
           await store.dispatch(`${entity}/createWithFormData`, item.value)
diff --git a/assets/vue/views/assignments/AssignmentSubmit.vue b/assets/vue/views/assignments/AssignmentSubmit.vue
index 30083226602..f74b67a1e04 100644
--- a/assets/vue/views/assignments/AssignmentSubmit.vue
+++ b/assets/vue/views/assignments/AssignmentSubmit.vue
@@ -226,7 +226,7 @@ uppy.on("file-added", (file) => {
     filetype: "file",
     parentResourceNodeId,
     parentId: publicationId,
-    resourceLinkList: JSON.stringify([{ cid, sid, gid, visibility: 2 }]),
+    resourceLinkList: JSON.stringify([{ visibility: 2 }]),
   })
 })
 uppy.on("upload-success", () => {
@@ -257,7 +257,7 @@ async function submitText() {
   formData.append("filetype", "file") // ahora sí "file"
   formData.append("parentId", publicationId)
   formData.append("parentResourceNodeId", parentResourceNodeId)
-  formData.append("resourceLinkList", JSON.stringify([{ cid, sid, gid, visibility: 2 }]))
+  formData.append("resourceLinkList", JSON.stringify([{ visibility: 2 }]))
 
   try {
     await cStudentPublicationService.uploadStudentAssignment(formData, queryParams)
diff --git a/assets/vue/views/ccalendarevent/CCalendarEventCreate.vue b/assets/vue/views/ccalendarevent/CCalendarEventCreate.vue
index cf8dc1afbd6..5b0505ff479 100644
--- a/assets/vue/views/ccalendarevent/CCalendarEventCreate.vue
+++ b/assets/vue/views/ccalendarevent/CCalendarEventCreate.vue
@@ -162,18 +162,12 @@ const onClickCreateEvent = async () => {
   const itemModel = { ...createForm.value.v$.item.$model }
 
   const cid = Number(route.query.cid ?? 0)
-  const sid = Number(route.query.sid ?? 0)
-  const gid = Number(route.query.gid ?? 0)
 
+  // Course event: bind only the visibility; the course context (cid/sid/gid) is
+  // derived server-side from the gated session course. Personal/global events
+  // (cid === 0) send no link at all.
   if (cid > 0) {
-    itemModel.resourceLinkList = [
-      {
-        cid,
-        sid: sid > 0 ? sid : null,
-        gid: gid > 0 ? gid : null,
-        visibility: RESOURCE_LINK_PUBLISHED,
-      },
-    ]
+    itemModel.resourceLinkList = [{ visibility: RESOURCE_LINK_PUBLISHED }]
   }
 
   itemModel.isGlobal = effectiveIsGlobal.value
diff --git a/assets/vue/views/ccalendarevent/CCalendarEventList.vue b/assets/vue/views/ccalendarevent/CCalendarEventList.vue
index 20a212c39cb..98f96898904 100644
--- a/assets/vue/views/ccalendarevent/CCalendarEventList.vue
+++ b/assets/vue/views/ccalendarevent/CCalendarEventList.vue
@@ -910,19 +910,10 @@ async function onCreateEventForm() {
     if (itemModel["@id"]) {
       await store.dispatch("ccalendarevent/update", itemModel)
     } else {
+      // Course event: bind only the visibility; the course context
+      // (cid/sid/gid) is derived server-side from the gated session course.
       if (course.value) {
-        const gidFromRoute = Number(route.query.gid ?? 0)
-        const gidFromStore = Number(group.value?.id ?? 0)
-        const effectiveGid = gidFromStore > 0 ? gidFromStore : gidFromRoute
-
-        itemModel.resourceLinkList = [
-          {
-            cid: course.value.id,
-            sid: session.value?.id ?? null,
-            gid: effectiveGid > 0 ? effectiveGid : null,
-            visibility: RESOURCE_LINK_PUBLISHED,
-          },
-        ]
+        itemModel.resourceLinkList = [{ visibility: RESOURCE_LINK_PUBLISHED }]
       }
 
       await store.dispatch("ccalendarevent/create", itemModel)
diff --git a/assets/vue/views/ctoolintro/Create.vue b/assets/vue/views/ctoolintro/Create.vue
index 76c92536f37..e266c3dae48 100644
--- a/assets/vue/views/ctoolintro/Create.vue
+++ b/assets/vue/views/ctoolintro/Create.vue
@@ -57,13 +57,8 @@ export default {
 
     item.value.parentResourceNodeId = Number(route.query.parentResourceNodeId)
     item.value.courseTool = `/api/c_tools/${ctoolId}`
-    item.value.resourceLinkList = [
-      {
-        sid: sessionId,
-        cid: courseId,
-        visibility: RESOURCE_LINK_PUBLISHED,
-      },
-    ]
+    // Course context derived server-side from the gated session course.
+    item.value.resourceLinkList = [{ visibility: RESOURCE_LINK_PUBLISHED }]
 
     async function getIntro() {
       try {
diff --git a/assets/vue/views/ctoolintro/Update.vue b/assets/vue/views/ctoolintro/Update.vue
index d26ea0a0a62..eb9f1c563f7 100644
--- a/assets/vue/views/ctoolintro/Update.vue
+++ b/assets/vue/views/ctoolintro/Update.vue
@@ -20,7 +20,6 @@ import { ref } from "vue"
 import { useRoute, useRouter } from "vue-router"
 import useVuelidate from "@vuelidate/core"
 import { RESOURCE_LINK_PUBLISHED } from "../../constants/entity/resourcelink"
-import { getCourseContext } from "../../utils/courseContext"
 import cToolIntroService from "../../services/cToolIntroService"
 
 const servicePrefix = "ctoolintro"
@@ -38,7 +37,6 @@ export default {
     const route = useRoute()
     const router = useRouter()
     const item = ref({})
-    const { cid, sid } = getCourseContext()
 
     let toolId = route.query.ctoolId
     let ctoolintroId = route.query.ctoolintroIid
@@ -55,13 +53,8 @@ export default {
       })
 
     item.value["courseTool"] = "/api/c_tools/" + toolId
-    item.value["resourceLinkList"] = [
-      {
-        sid,
-        cid,
-        visibility: RESOURCE_LINK_PUBLISHED, // visible by default
-      },
-    ]
+    // Course context derived server-side from the gated session course.
+    item.value["resourceLinkList"] = [{ visibility: RESOURCE_LINK_PUBLISHED }]
 
     function onUpdated() {
       router.go(-1)
diff --git a/assets/vue/views/documents/Create.vue b/assets/vue/views/documents/Create.vue
index e830adc4cac..e8d76a8dddb 100644
--- a/assets/vue/views/documents/Create.vue
+++ b/assets/vue/views/documents/Create.vue
@@ -50,14 +50,9 @@ export default {
   },
   created() {
     this.item.parentResourceNodeId = this.$route.params.node
-    this.item.resourceLinkList = JSON.stringify([
-      {
-        gid: this.$route.query.gid,
-        sid: this.$route.query.sid,
-        cid: this.$route.query.cid,
-        visibility: RESOURCE_LINK_PUBLISHED, // visible by default
-      },
-    ])
+    // Course context (cid/sid/gid) is derived server-side from the gated
+    // session course; only the visibility needs to travel in the body.
+    this.item.resourceLinkList = JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }])
   },
   methods: {
     ...mapActions("documents", ["createWithFormData", "reset"]),
diff --git a/assets/vue/views/documents/CreateFile.vue b/assets/vue/views/documents/CreateFile.vue
index 1117479cb2a..7122c6c1693 100644
--- a/assets/vue/views/documents/CreateFile.vue
+++ b/assets/vue/views/documents/CreateFile.vue
@@ -122,14 +122,9 @@ watch(created, (val) => {
 })
 
 item.value.parentResourceNodeId = route.params.node ?? route.params.id ?? null
-item.value.resourceLinkList = JSON.stringify([
-  {
-    gid: route.query.gid,
-    sid: route.query.sid,
-    cid: route.query.cid,
-    visibility: RESOURCE_LINK_PUBLISHED,
-  },
-])
+// Course context (cid/sid/gid) is derived server-side from the gated session
+// course; only the visibility needs to travel in the body.
+item.value.resourceLinkList = JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }])
 
 onMounted(async () => {
   await fetchTemplates()
diff --git a/assets/vue/views/documents/DocumentForHtmlEditor.vue b/assets/vue/views/documents/DocumentForHtmlEditor.vue
index 33e4f7d05a0..b11c0d48b3f 100644
--- a/assets/vue/views/documents/DocumentForHtmlEditor.vue
+++ b/assets/vue/views/documents/DocumentForHtmlEditor.vue
@@ -640,14 +640,6 @@ export default {
       return n || 1
     },
 
-    getContextIds() {
-      const q = this.$route?.query || {}
-      const cid = this.normalizeNodeId(q.cid) || 0
-      const sid = this.normalizeNodeId(q.sid) || 0
-      const gid = this.normalizeNodeId(q.gid) || 0
-      return { cid, sid, gid }
-    },
-
     getRootNodeId() {
       return this.trailRootId || this.folderTrail?.[0]?.id || null
     },
@@ -772,19 +764,11 @@ export default {
       this.submitted = true
       if (!this.item.title?.trim()) return
 
-      const { cid, sid, gid } = this.getContextIds()
-
       try {
         this.item.filetype = "folder"
         this.item.parentResourceNodeId = this.getCurrentNodeId()
-        this.item.resourceLinkList = JSON.stringify([
-          {
-            gid,
-            sid,
-            cid,
-            visibility: RESOURCE_LINK_PUBLISHED,
-          },
-        ])
+        // Course context derived server-side from the gated session course.
+        this.item.resourceLinkList = JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }])
 
         await this.create(this.item)
 
@@ -828,21 +812,13 @@ export default {
         return
       }
 
-      const { cid, sid, gid } = this.getContextIds()
-
       const payload = {
         title: file.name,
         filetype: "file",
         uploadFile: file,
         parentResourceNodeId: this.getCurrentNodeId(),
-        resourceLinkList: JSON.stringify([
-          {
-            gid,
-            sid,
-            cid,
-            visibility: RESOURCE_LINK_PUBLISHED,
-          },
-        ]),
+        // Course context derived server-side from the gated session course.
+        resourceLinkList: JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }]),
       }
 
       try {
diff --git a/assets/vue/views/documents/DocumentsGenerateMedia.vue b/assets/vue/views/documents/DocumentsGenerateMedia.vue
index 8421ccc28ba..db8b29fc017 100644
--- a/assets/vue/views/documents/DocumentsGenerateMedia.vue
+++ b/assets/vue/views/documents/DocumentsGenerateMedia.vue
@@ -601,8 +601,9 @@ function base64ToFile(base64, filename, mime) {
   return new File([blob], filename, { type: mime })
 }
 
+// Course context derived server-side from the gated session course.
 function buildResourceLinkList() {
-  return JSON.stringify([{ gid, sid, cid, visibility: RESOURCE_LINK_PUBLISHED }])
+  return JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }])
 }
 
 function canvasMimeFromContentType(contentType) {
diff --git a/assets/vue/views/documents/DocumentsList.vue b/assets/vue/views/documents/DocumentsList.vue
index 0f74df29dd0..424ad3ef651 100644
--- a/assets/vue/views/documents/DocumentsList.vue
+++ b/assets/vue/views/documents/DocumentsList.vue
@@ -1187,14 +1187,8 @@ function createNewFolder() {
     if (!item.value.id) {
       item.value.filetype = "folder"
       item.value.parentResourceNodeId = route.params.node
-      item.value.resourceLinkList = JSON.stringify([
-        {
-          gid,
-          sid,
-          cid,
-          visibility: RESOURCE_LINK_PUBLISHED,
-        },
-      ])
+      // Course context derived server-side from the gated session course.
+      item.value.resourceLinkList = JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }])
 
       tableLoading.value = true
       store.dispatch("documents/createWithFormData", item.value).then(() => {
diff --git a/assets/vue/views/documents/SvgEditor.vue b/assets/vue/views/documents/SvgEditor.vue
index a67ae5f6fe2..7712845ecf1 100644
--- a/assets/vue/views/documents/SvgEditor.vue
+++ b/assets/vue/views/documents/SvgEditor.vue
@@ -1295,14 +1295,8 @@ async function saveSvg() {
         contentFileExtension: "svg",
         contentFileMimeType: "image/svg+xml",
         parentResourceNodeId: getParentResourceNodeId(),
-        resourceLinkList: JSON.stringify([
-          {
-            gid: route.query.gid,
-            sid: route.query.sid,
-            cid: route.query.cid,
-            visibility: RESOURCE_LINK_PUBLISHED,
-          },
-        ]),
+        // Course context derived server-side from the gated session course.
+        resourceLinkList: JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }]),
         indexDocumentContent: false,
         language: language.value || "",
       })
diff --git a/assets/vue/views/glossary/GlossaryGenerateTerms.vue b/assets/vue/views/glossary/GlossaryGenerateTerms.vue
index 17c39deb939..45feef28464 100644
--- a/assets/vue/views/glossary/GlossaryGenerateTerms.vue
+++ b/assets/vue/views/glossary/GlossaryGenerateTerms.vue
@@ -292,7 +292,6 @@ import { useI18n } from "vue-i18n"
 import LayoutFormGeneric from "../../components/layout/LayoutFormGeneric.vue"
 import BaseIcon from "../../components/basecomponents/BaseIcon.vue"
 import BaseButton from "../../components/basecomponents/BaseButton.vue"
-import { getCourseContext } from "../../utils/courseContext"
 import { RESOURCE_LINK_PUBLISHED } from "../../constants/entity/resourcelink"
 import glossaryService from "../../services/glossaryService"
 import { useNotification } from "../../composables/notification"
@@ -312,8 +311,6 @@ const platform = usePlatformConfig()
 const cidReqStore = useCidReqStore()
 const { course } = storeToRefs(cidReqStore)
 
-const { cid, sid } = getCourseContext()
-
 const { isAllowedToEdit } = useIsAllowedToEdit({ tutor: true, coach: true, sessionCoach: true })
 
 const canEditGlossary = computed(() => {
@@ -373,15 +370,8 @@ const isBusy = ref(false)
 
 const parentResourceNodeId = ref(Number(route.params.node))
 
-const resourceLinkList = ref(
-  JSON.stringify([
-    {
-      sid,
-      cid,
-      visibility: RESOURCE_LINK_PUBLISHED,
-    },
-  ]),
-)
+// Course context derived server-side from the gated session course.
+const resourceLinkList = ref(JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }]))
 
 const canGenerate = computed(() => {
   return canEditGlossary.value && providers.value.length > 0 && prompt.value.trim().length > 0 && !isBusy.value
diff --git a/assets/vue/views/glossary/GlossaryList.vue b/assets/vue/views/glossary/GlossaryList.vue
index 368aa93bd0b..f18164223f5 100644
--- a/assets/vue/views/glossary/GlossaryList.vue
+++ b/assets/vue/views/glossary/GlossaryList.vue
@@ -156,15 +156,8 @@ const searchTerm = ref("")
 const searchBoxTouched = ref(false)
 const parentResourceNodeId = ref(Number(route.params.node))
 
-const resourceLinkList = ref(
-  JSON.stringify([
-    {
-      sid: route.query.sid,
-      cid: route.query.cid,
-      visibility: RESOURCE_LINK_PUBLISHED,
-    },
-  ]),
-)
+// Course context derived server-side from the gated session course.
+const resourceLinkList = ref(JSON.stringify([{ visibility: RESOURCE_LINK_PUBLISHED }]))
 
 const glossaries = ref([])
 const view = ref("list")
diff --git a/src/CoreBundle/Entity/Listener/ResourceListener.php b/src/CoreBundle/Entity/Listener/ResourceListener.php
index cd03e322fae..a50b2cf6b2a 100644
--- a/src/CoreBundle/Entity/Listener/ResourceListener.php
+++ b/src/CoreBundle/Entity/Listener/ResourceListener.php
@@ -9,6 +9,7 @@
 use Chamilo\CoreBundle\Controller\Api\BaseResourceFileAction;
 use Chamilo\CoreBundle\Entity\AbstractResource;
 use Chamilo\CoreBundle\Entity\AccessUrl;
+use Chamilo\CoreBundle\Entity\Course;
 use Chamilo\CoreBundle\Entity\EntityAccessUrlInterface;
 use Chamilo\CoreBundle\Entity\Language;
 use Chamilo\CoreBundle\Entity\PersonalFile;
@@ -19,12 +20,14 @@
 use Chamilo\CoreBundle\Entity\ResourceToRootInterface;
 use Chamilo\CoreBundle\Entity\ResourceType;
 use Chamilo\CoreBundle\Entity\ResourceWithAccessUrlInterface;
+use Chamilo\CoreBundle\Entity\Session;
 use Chamilo\CoreBundle\Entity\User;
 use Chamilo\CoreBundle\Helpers\ResourceHelper;
 use Chamilo\CoreBundle\Tool\ToolChain;
 use Chamilo\CoreBundle\Traits\AccessUrlListenerTrait;
 use Chamilo\CourseBundle\Entity\CCalendarEvent;
 use Chamilo\CourseBundle\Entity\CDocument;
+use Chamilo\CourseBundle\Entity\CGroup;
 use Cocur\Slugify\SlugifyInterface;
 use Doctrine\ORM\Event\PrePersistEventArgs;
 use Doctrine\ORM\Event\PreUpdateEventArgs;
@@ -299,6 +302,11 @@ public function prePersist(AbstractResource $resource, PrePersistEventArgs $even
         // Update resourceNode title from Resource.
         $this->updateResourceName($resource);
 
+        // Bind a single-entry resourceLinkList to the session-resolved course
+        // context before the links are materialized, so the request body cannot
+        // target a foreign course (IDOR).
+        $this->normalizeSingleLinkContextFromSession($resource);
+
         BaseResourceFileAction::setLinks($resource, $em);
 
         // Upload File was set in BaseResourceFileAction.php
@@ -336,6 +344,75 @@ public function prePersist(AbstractResource $resource, PrePersistEventArgs $even
         }
     }
 
+    /**
+     * Forces a single-entry resourceLinkList to bind to the current course
+     * context resolved by CidReqListener (stored in the session), which is the
+     * same context that gated the operation's `security:` expression.
+     *
+     * Only the link visibility is taken from the request body; the cid/sid/gid
+     * are overwritten with the session context, so a request body cannot bind a
+     * resource to a foreign course (IDOR). Requests carrying more than one link
+     * are an explicit multi-context write and are left untouched, as are
+     * user/usergroup-scoped links (e.g. personal files) and any non-API or
+     * out-of-course-context persist (course copy, fixtures, CLI commands).
+     */
+    public function normalizeSingleLinkContextFromSession(AbstractResource $resource): void
+    {
+        $links = $resource->getResourceLinkArray();
+
+        // Multiple entries are an explicit multi-context request: honor as-is.
+        if (1 !== \count($links)) {
+            return;
+        }
+
+        $entry = $links[0];
+        if (!\is_array($entry)) {
+            return;
+        }
+
+        // User/usergroup-scoped links (e.g. personal files) are not course links.
+        if (!empty($entry['uid']) || !empty($entry['ugid'])) {
+            return;
+        }
+
+        $request = $this->request->getMainRequest();
+        if (null === $request || !$request->hasSession()) {
+            return;
+        }
+
+        // Restrict to API Platform requests: the only path where the
+        // resourceLinkList originates from untrusted request input. Programmatic
+        // persists must keep their explicit context.
+        if (!str_starts_with($request->getPathInfo(), '/api/')) {
+            return;
+        }
+
+        $session = $request->getSession();
+
+        $course = $session->get('course');
+        if (!$course instanceof Course) {
+            return;
+        }
+
+        $context = ['cid' => (int) $course->getId()];
+
+        $courseSession = $session->get('session');
+        if ($courseSession instanceof Session) {
+            $context['sid'] = (int) $courseSession->getId();
+        }
+
+        $group = $session->get('group');
+        if ($group instanceof CGroup) {
+            $context['gid'] = (int) $group->getIid();
+        }
+
+        $context['visibility'] = isset($entry['visibility'])
+            ? (int) $entry['visibility']
+            : ResourceLink::VISIBILITY_PUBLISHED;
+
+        $resource->setResourceLinkArray([$context]);
+    }
+
     /**
      * When updating a Resource.
      */

From 7957aa941de2a821b480cbfe00a5540c13bdf374 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Mon, 1 Jun 2026 12:54:36 -0500
Subject: [PATCH 36/38] Internal: API: Document: Add OpenAPI query parameters
 to `/calendar/my-students-schedule` endpoint

Describe the `sid`, `start`, and `end` query parameters in the OpenAPI spec to improve API documentation and clarify their usage.
---
 src/CoreBundle/Entity/Session.php | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/src/CoreBundle/Entity/Session.php b/src/CoreBundle/Entity/Session.php
index aff3dbc43b4..3a6ba3fd390 100644
--- a/src/CoreBundle/Entity/Session.php
+++ b/src/CoreBundle/Entity/Session.php
@@ -13,6 +13,8 @@
 use ApiPlatform\Metadata\Link;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
+use ApiPlatform\OpenApi\Model\Operation;
+use ApiPlatform\OpenApi\Model\Parameter;
 use Chamilo\CoreBundle\ApiResource\SessionPlanItem;
 use Chamilo\CoreBundle\Controller\Api\CalendarMyStudentsScheduleAction;
 use Chamilo\CoreBundle\Controller\Api\CreateSessionWithUsersAndCoursesAction;
@@ -118,6 +120,31 @@
         new GetCollection(
             uriTemplate: '/calendar/my-students-schedule.{_format}',
             controller: CalendarMyStudentsScheduleAction::class,
+            openapi: new Operation(
+                parameters: [
+                    new Parameter(
+                        name: 'sid',
+                        in: 'query',
+                        description: 'Session identifier. When omitted (or <= 0) the endpoint returns the sessions where the current user is a tutor/coach; when provided it returns the calendar events of that session.',
+                        required: false,
+                        schema: ['type' => 'integer'],
+                    ),
+                    new Parameter(
+                        name: 'start',
+                        in: 'query',
+                        description: 'Range start (ISO 8601 date-time). Required together with "end" to return events when "sid" is provided.',
+                        required: false,
+                        schema: ['type' => 'string', 'format' => 'date-time'],
+                    ),
+                    new Parameter(
+                        name: 'end',
+                        in: 'query',
+                        description: 'Range end (ISO 8601 date-time). Required together with "start" to return events when "sid" is provided.',
+                        required: false,
+                        schema: ['type' => 'string', 'format' => 'date-time'],
+                    ),
+                ],
+            ),
             paginationEnabled: false,
             security: "is_granted('ROLE_USER')",
             output: false,

From 91fd5767bcf85ec04ccd937cc4e689c18d981674 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Mon, 1 Jun 2026 14:51:54 -0500
Subject: [PATCH 37/38] Security: Enforce session-resolved context in LP
 reordering and collection APIs

See advisory GHSA-8jgq-6rxm-3685
---
 .../Controller/Api/LpReorderController.php    | 26 +++++++++++++++----
 src/CoreBundle/Entity/SocialPost.php          |  1 +
 .../State/LpCollectionStateProvider.php       | 26 +++++++++++--------
 .../State/UsergroupStateProvider.php          | 12 ++++-----
 4 files changed, 43 insertions(+), 22 deletions(-)

diff --git a/src/CoreBundle/Controller/Api/LpReorderController.php b/src/CoreBundle/Controller/Api/LpReorderController.php
index fb60861d8e2..2b3ab4be737 100644
--- a/src/CoreBundle/Controller/Api/LpReorderController.php
+++ b/src/CoreBundle/Controller/Api/LpReorderController.php
@@ -6,6 +6,8 @@
 
 namespace Chamilo\CoreBundle\Controller\Api;
 
+use Chamilo\CoreBundle\Entity\Course;
+use Chamilo\CoreBundle\Helpers\CidReqHelper;
 use Chamilo\CourseBundle\Repository\CLpRepository;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Request;
@@ -13,7 +15,8 @@
 final class LpReorderController
 {
     public function __construct(
-        private CLpRepository $lpRepo
+        private CLpRepository $lpRepo,
+        private CidReqHelper $cidReqHelper,
     ) {}
 
     public function __invoke(Request $request): JsonResponse
@@ -24,16 +27,29 @@ public function __invoke(Request $request): JsonResponse
     public function reorder(Request $request): JsonResponse
     {
         $data = json_decode($request->getContent() ?: '[]', true);
-        $courseId = isset($data['courseId']) ? (int) $data['courseId'] : null;
-        $sid = \array_key_exists('sid', $data) ? (null !== $data['sid'] ? (int) $data['sid'] : null) : null;
+        if (!\is_array($data)) {
+            return new JsonResponse(['error' => 'Invalid payload'], 400);
+        }
+
         $order = $data['order'] ?? $data['ids'] ?? null;
         $categoryId = \array_key_exists('categoryId', $data) ? (null !== $data['categoryId'] ? (int) $data['categoryId'] : null) : null;
 
-        if (!$courseId || !\is_array($order)) {
+        if (!\is_array($order)) {
             return new JsonResponse(['error' => 'Invalid payload'], 400);
         }
 
-        $this->lpRepo->reorderByIds($courseId, $sid, array_map('intval', $order), $categoryId);
+        // The course/session come from the session context resolved by CidReqListener from
+        // the cid/sid query params, which is the same context that gated this operation's
+        // contextual teacher role. The request body is never trusted for the course id, so
+        // a teacher cannot reorder another course's learning paths (IDOR).
+        $course = $this->cidReqHelper->getCourseEntity();
+        if (!$course instanceof Course) {
+            return new JsonResponse(['error' => 'Missing course context'], 400);
+        }
+
+        $sid = $this->cidReqHelper->getSessionId();
+
+        $this->lpRepo->reorderByIds((int) $course->getId(), $sid, array_map('intval', $order), $categoryId);
 
         return new JsonResponse(null, 204);
     }
diff --git a/src/CoreBundle/Entity/SocialPost.php b/src/CoreBundle/Entity/SocialPost.php
index f2debea5b8a..c126d2992a8 100644
--- a/src/CoreBundle/Entity/SocialPost.php
+++ b/src/CoreBundle/Entity/SocialPost.php
@@ -61,6 +61,7 @@
             uriTemplate: '/social_posts/{id}/attachments',
             controller: SocialPostAttachmentsController::class,
             normalizationContext: ['groups' => ['attachment:read']],
+            security: "is_granted('VIEW', object)",
         ),
         new GetCollection(
             paginationItemsPerPage: 30,
diff --git a/src/CoreBundle/State/LpCollectionStateProvider.php b/src/CoreBundle/State/LpCollectionStateProvider.php
index 0e6b2ae216e..6d064ec433c 100644
--- a/src/CoreBundle/State/LpCollectionStateProvider.php
+++ b/src/CoreBundle/State/LpCollectionStateProvider.php
@@ -11,6 +11,7 @@
 use Chamilo\CoreBundle\Entity\Course;
 use Chamilo\CoreBundle\Entity\Session as CoreSession;
 use Chamilo\CoreBundle\Entity\User;
+use Chamilo\CoreBundle\Helpers\CidReqHelper;
 use Chamilo\CoreBundle\Helpers\LpAdvancedAccessHelper;
 use Chamilo\CoreBundle\Settings\SettingsManager;
 use Chamilo\CourseBundle\Entity\CLp;
@@ -20,6 +21,7 @@
 use DateTimeZone;
 use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 
 /**
  * @template-implements ProviderInterface<CLp>
@@ -32,6 +34,7 @@ public function __construct(
         private Security $security,
         private SettingsManager $settingsManager,
         private LpAdvancedAccessHelper $advancedAccessHelper,
+        private CidReqHelper $cidReqHelper,
     ) {}
 
     public function supports(Operation $op, array $uriVariables = [], array $ctx = []): bool
@@ -47,20 +50,21 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
             return [];
         }
 
-        $course = $this->em->createQuery(
-            'SELECT c
-               FROM '.Course::class.' c
-               JOIN c.resourceNode rn
-              WHERE rn.id = :nid'
-        )
-            ->setParameter('nid', $parentNodeId)
-            ->getOneOrNullResult()
-        ;
-
-        if (!$course) {
+        // The operation's contextual-role security already authorized the current course,
+        // so the course is taken from the session context (not from client input). The
+        // client-supplied resourceNode.parent is then only accepted when it matches that
+        // course's resource node, so a member of one course cannot list another course's
+        // learning paths by pointing parent at a foreign course node (IDOR).
+        $course = $this->cidReqHelper->getDoctrineCourseEntity();
+        if (!$course instanceof Course) {
             return [];
         }
 
+        $courseNode = $course->getResourceNode();
+        if (null === $courseNode || $parentNodeId !== (int) $courseNode->getId()) {
+            throw new AccessDeniedHttpException('resourceNode.parent does not match the current course.');
+        }
+
         $sid = isset($f['sid']) ? (int) $f['sid'] : null;
         $title = $f['title'] ?? null;
 
diff --git a/src/CoreBundle/State/UsergroupStateProvider.php b/src/CoreBundle/State/UsergroupStateProvider.php
index e8937f23926..a210aaa448a 100644
--- a/src/CoreBundle/State/UsergroupStateProvider.php
+++ b/src/CoreBundle/State/UsergroupStateProvider.php
@@ -62,12 +62,12 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
 
         switch ($operationName) {
             case 'get_my_usergroups':
-                $userId = $context['request_attributes']['_api_filters']['userId'] ?? null;
-                if (!$userId) {
-                    /** @var User $user */
-                    $user = $this->security->getUser();
-                    $userId = $user?->getId();
-                }
+                // "my" groups are always the current user's. Ignore any client-supplied
+                // userId so an authenticated user cannot disclose another user's group
+                // memberships (IDOR).
+                /** @var User|null $user */
+                $user = $this->security->getUser();
+                $userId = $user?->getId();
                 if (!$userId) {
                     throw new Exception('User ID is required');
                 }

From 9d3ce8a76e0b6c36aee95a554633f056fbb6e534 Mon Sep 17 00:00:00 2001
From: Angel Fernando Quiroz Campos <1697880+AngelFQC@users.noreply.github.com>
Date: Mon, 1 Jun 2026 18:00:02 -0500
Subject: [PATCH 38/38] Security: Enforce contextual course scoping and
 visibility in blog-related APIs

See advisory GHSA-8jgq-6rxm-3685
---
 .../Extension/CBlogCourseLinkExtension.php    | 112 ++++++++++++++++++
 .../Extension/CourseLinkExtensionTrait.php    |  33 ++++--
 src/CourseBundle/Entity/CBlogAttachment.php   |   3 +
 src/CourseBundle/Entity/CBlogPost.php         |   3 +
 src/CourseBundle/Entity/CBlogTask.php         |   3 +
 src/CourseBundle/Entity/CBlogTaskRelUser.php  |   3 +
 6 files changed, 145 insertions(+), 12 deletions(-)
 create mode 100644 src/CoreBundle/DataProvider/Extension/CBlogCourseLinkExtension.php

diff --git a/src/CoreBundle/DataProvider/Extension/CBlogCourseLinkExtension.php b/src/CoreBundle/DataProvider/Extension/CBlogCourseLinkExtension.php
new file mode 100644
index 00000000000..445d309aae0
--- /dev/null
+++ b/src/CoreBundle/DataProvider/Extension/CBlogCourseLinkExtension.php
@@ -0,0 +1,112 @@
+<?php
+
+declare(strict_types=1);
+
+/* For licensing terms, see /license.txt */
+
+namespace Chamilo\CoreBundle\DataProvider\Extension;
+
+use ApiPlatform\Doctrine\Orm\Extension\QueryCollectionExtensionInterface;
+use ApiPlatform\Doctrine\Orm\Util\QueryNameGeneratorInterface;
+use ApiPlatform\Metadata\Operation;
+use Chamilo\CoreBundle\Entity\ResourceLink;
+use Chamilo\CoreBundle\Helpers\CidReqHelper;
+use Chamilo\CourseBundle\Entity\CBlogAttachment;
+use Chamilo\CourseBundle\Entity\CBlogComment;
+use Chamilo\CourseBundle\Entity\CBlogPost;
+use Chamilo\CourseBundle\Entity\CBlogTask;
+use Chamilo\CourseBundle\Entity\CBlogTaskRelUser;
+use Doctrine\DBAL\Types\Types;
+use Doctrine\ORM\QueryBuilder;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+/**
+ * Scopes blog sub-resource collections to the course resolved from the session
+ * (CidReqHelper) — the same course that gated the operation's contextual role.
+ *
+ * These entities do not extend AbstractResource, so their course link lives on
+ * the related CBlog (project). Without this extension the collections declare no
+ * course filter, so any authenticated user enrolled in one course could list
+ * another course's blog data straight from the collection endpoint (IDOR).
+ *
+ * The extension joins each resource to its CBlog, then to the ResourceNode and
+ * ResourceLink, and restricts to the session course. The item (Get) operations
+ * are unaffected: they keep their own per-object VIEW security.
+ */
+final class CBlogCourseLinkExtension implements QueryCollectionExtensionInterface
+{
+    use CourseLinkExtensionTrait;
+
+    /**
+     * resourceClass => [intermediate relation from the root or null, blog relation].
+     *
+     * CBlogComment may have a null blog but always belongs to a post, so it is
+     * scoped through post.blog.
+     */
+    private const BLOG_PATHS = [
+        CBlogPost::class => [null, 'blog'],
+        CBlogTask::class => [null, 'blog'],
+        CBlogTaskRelUser::class => [null, 'blog'],
+        CBlogAttachment::class => [null, 'blog'],
+        CBlogComment::class => ['post', 'blog'],
+    ];
+
+    public function __construct(
+        private readonly Security $security,
+        private readonly CidReqHelper $cidReqHelper,
+    ) {}
+
+    public function applyToCollection(
+        QueryBuilder $queryBuilder,
+        QueryNameGeneratorInterface $queryNameGenerator,
+        string $resourceClass,
+        ?Operation $operation = null,
+        array $context = []
+    ): void {
+        if (!isset(self::BLOG_PATHS[$resourceClass])) {
+            return;
+        }
+
+        if (null === $this->security->getUser()) {
+            throw new AccessDeniedException();
+        }
+
+        $rootAlias = $queryBuilder->getRootAliases()[0];
+        [$intermediate, $blogRelation] = self::BLOG_PATHS[$resourceClass];
+
+        $blogFromAlias = $rootAlias;
+        if (null !== $intermediate) {
+            $queryBuilder->innerJoin("$rootAlias.$intermediate", 'blog_cl_inter');
+            $blogFromAlias = 'blog_cl_inter';
+        }
+
+        $queryBuilder
+            ->innerJoin("$blogFromAlias.$blogRelation", 'blog_cl')
+            ->innerJoin('blog_cl.resourceNode', 'blog_cl_node')
+            ->innerJoin('blog_cl_node.resourceLinks', 'blog_cl_links')
+            ->distinct()
+        ;
+
+        $courseId = (int) $this->cidReqHelper->getCourseId();
+        if ($courseId <= 0) {
+            // No resolved course context: fail closed rather than leak every course.
+            $queryBuilder->andWhere('1 = 0');
+
+            return;
+        }
+
+        $queryBuilder
+            ->andWhere('blog_cl_links.course = :blogClCourseId')
+            ->setParameter('blogClCourseId', $courseId, Types::INTEGER)
+        ;
+
+        // Students never see draft (unpublished) blogs; teachers/admins do.
+        if (!$this->canViewDraftResources()) {
+            $queryBuilder
+                ->andWhere('blog_cl_links.visibility != :blogClDraft')
+                ->setParameter('blogClDraft', ResourceLink::VISIBILITY_DRAFT, Types::INTEGER)
+            ;
+        }
+    }
+}
diff --git a/src/CoreBundle/DataProvider/Extension/CourseLinkExtensionTrait.php b/src/CoreBundle/DataProvider/Extension/CourseLinkExtensionTrait.php
index 3b840768077..2cb0340fa85 100644
--- a/src/CoreBundle/DataProvider/Extension/CourseLinkExtensionTrait.php
+++ b/src/CoreBundle/DataProvider/Extension/CourseLinkExtensionTrait.php
@@ -37,21 +37,30 @@ protected function addCourseLinkWithVisibilityConditions(QueryBuilder $queryBuil
 
     protected function addVisibilityCondition(QueryBuilder $queryBuilder): void
     {
-        // Context roles (ROLE_CURRENT_COURSE_*) live in User::$temporaryRoles and appear in
-        // $user->getRoles(), but Symfony's AbstractToken::getRoleNames() only returns roles
-        // fixed at token-creation time. isGranted() therefore misses them.
+        if ($this->canViewDraftResources()) {
+            return;
+        }
+
+        $queryBuilder
+            ->andWhere('resource_links.visibility != :visibilityDraft')
+            ->setParameter('visibilityDraft', ResourceLink::VISIBILITY_DRAFT)
+        ;
+    }
+
+    /**
+     * Whether the current user may see draft (unpublished) course resources:
+     * platform admins and teachers of the current course/session.
+     *
+     * Context roles (ROLE_CURRENT_COURSE_*) live in User::$temporaryRoles and appear in
+     * $user->getRoles(), but Symfony's AbstractToken::getRoleNames() only returns roles
+     * fixed at token-creation time, so isGranted() misses them — read them from the User.
+     */
+    protected function canViewDraftResources(): bool
+    {
         $roles = $this->security->getUser()?->getRoles() ?? [];
 
-        $allowDraft =
-            $this->security->isGranted('ROLE_ADMIN')
+        return $this->security->isGranted('ROLE_ADMIN')
             || \in_array('ROLE_CURRENT_COURSE_TEACHER', $roles, true)
             || \in_array('ROLE_CURRENT_COURSE_SESSION_TEACHER', $roles, true);
-
-        if (!$allowDraft) {
-            $queryBuilder
-                ->andWhere('resource_links.visibility != :visibilityDraft')
-                ->setParameter('visibilityDraft', ResourceLink::VISIBILITY_DRAFT)
-            ;
-        }
     }
 }
diff --git a/src/CourseBundle/Entity/CBlogAttachment.php b/src/CourseBundle/Entity/CBlogAttachment.php
index 6547961d699..36b2d12b61f 100644
--- a/src/CourseBundle/Entity/CBlogAttachment.php
+++ b/src/CourseBundle/Entity/CBlogAttachment.php
@@ -6,6 +6,8 @@
 
 namespace Chamilo\CourseBundle\Entity;
 
+use ApiPlatform\Doctrine\Orm\Filter\SearchFilter;
+use ApiPlatform\Metadata\ApiFilter;
 use ApiPlatform\Metadata\ApiResource;
 use ApiPlatform\Metadata\Get;
 use ApiPlatform\Metadata\GetCollection;
@@ -32,6 +34,7 @@
     normalizationContext: ['groups' => ['blog_attachment:read']],
     denormalizationContext: ['groups' => ['blog_attachment:write']]
 )]
+#[ApiFilter(SearchFilter::class, properties: ['post' => 'exact'])]
 class CBlogAttachment
 {
     #[Groups(['blog_attachment:read', 'blog_post:read'])]
diff --git a/src/CourseBundle/Entity/CBlogPost.php b/src/CourseBundle/Entity/CBlogPost.php
index f5de92cd13e..210091769c0 100644
--- a/src/CourseBundle/Entity/CBlogPost.php
+++ b/src/CourseBundle/Entity/CBlogPost.php
@@ -6,6 +6,8 @@
 
 namespace Chamilo\CourseBundle\Entity;
 
+use ApiPlatform\Doctrine\Orm\Filter\SearchFilter;
+use ApiPlatform\Metadata\ApiFilter;
 use ApiPlatform\Metadata\ApiResource;
 use ApiPlatform\Metadata\Delete;
 use ApiPlatform\Metadata\Get;
@@ -36,6 +38,7 @@
     denormalizationContext: ['groups' => ['blog_post:write']],
     paginationEnabled: true
 )]
+#[ApiFilter(SearchFilter::class, properties: ['blog' => 'exact'])]
 #[ORM\Entity(repositoryClass: CBlogPostRepository::class)]
 #[ORM\Table(name: 'c_blog_post')]
 #[ORM\HasLifecycleCallbacks]
diff --git a/src/CourseBundle/Entity/CBlogTask.php b/src/CourseBundle/Entity/CBlogTask.php
index 061db218e0a..f5dee9346ad 100644
--- a/src/CourseBundle/Entity/CBlogTask.php
+++ b/src/CourseBundle/Entity/CBlogTask.php
@@ -6,6 +6,8 @@
 
 namespace Chamilo\CourseBundle\Entity;
 
+use ApiPlatform\Doctrine\Orm\Filter\SearchFilter;
+use ApiPlatform\Metadata\ApiFilter;
 use ApiPlatform\Metadata\ApiResource;
 use ApiPlatform\Metadata\Delete;
 use ApiPlatform\Metadata\Get;
@@ -33,6 +35,7 @@
     normalizationContext: ['groups' => ['blog_task:read']],
     denormalizationContext: ['groups' => ['blog_task:write']]
 )]
+#[ApiFilter(SearchFilter::class, properties: ['blog' => 'exact'])]
 class CBlogTask
 {
     #[ORM\Column(name: 'iid', type: 'integer')]
diff --git a/src/CourseBundle/Entity/CBlogTaskRelUser.php b/src/CourseBundle/Entity/CBlogTaskRelUser.php
index 0cd8b4da830..c150f2fa162 100644
--- a/src/CourseBundle/Entity/CBlogTaskRelUser.php
+++ b/src/CourseBundle/Entity/CBlogTaskRelUser.php
@@ -6,6 +6,8 @@
 
 namespace Chamilo\CourseBundle\Entity;
 
+use ApiPlatform\Doctrine\Orm\Filter\SearchFilter;
+use ApiPlatform\Metadata\ApiFilter;
 use ApiPlatform\Metadata\ApiResource;
 use ApiPlatform\Metadata\Get;
 use ApiPlatform\Metadata\GetCollection;
@@ -34,6 +36,7 @@
     normalizationContext: ['groups' => ['task_rel_user:read']],
     denormalizationContext: ['groups' => ['task_rel_user:write']]
 )]
+#[ApiFilter(SearchFilter::class, properties: ['blog' => 'exact'])]
 class CBlogTaskRelUser
 {
     use UserTrait;