fix: check cardId for attachment

grnd-alt · grnd-alt · commit 440b52a2e311 · 2026-03-09T15:55:02.000+01:00
Signed-off-by: grnd-alt &lt;git@belakkaf.net&gt;
diff --git a/lib/Service/AttachmentService.php b/lib/Service/AttachmentService.php
@@ -251,6 +251,7 @@ public function update(int $cardId, int $attachmentId, string $data, string $typ
 		}
 
 		if ($service instanceof ICustomAttachmentService) {
+			$this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_EDIT);
 			try {
 				$attachment = new Attachment();
 				$attachment->setId($attachmentId);

Original file line number	Diff line number	Diff line change
`@@ -251,6 +251,7 @@ public function update(int $cardId, int $attachmentId, string $data, string $typ`
`251`	`251`	`}`
`252`	`252`
`253`	`253`	`if ($service instanceof ICustomAttachmentService) {`
	`254`	`+ $this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_EDIT);`
`254`	`255`	`try {`
`255`	`256`	`$attachment = new Attachment();`
`256`	`257`	`$attachment->setId($attachmentId);`