Merge pull request #4698 from IONOS-Productivity/fix/respect_edit_groups_for_templates

juliusknorr · web-flow · commit 1f483fcd350d · 2025-05-23T15:00:25.000+02:00
fix: Ensure edit permissions are checked before template file token generation
diff --git a/lib/TokenManager.php b/lib/TokenManager.php
@@ -185,6 +185,8 @@ public function generateWopiTokenForTemplate(
 			$updatable = $updatable && $shareUpdatable;
 		}
 
+		$updatable = $updatable && $this->permissionManager->userCanEdit($owneruid);
+
 		$serverHost = $this->urlGenerator->getAbsoluteURL('/');
 
 		return $this->wopiMapper->generateFileToken(

Original file line number	Diff line number	Diff line change
`@@ -185,6 +185,8 @@ public function generateWopiTokenForTemplate(`
`185`	`185`	`$updatable = $updatable && $shareUpdatable;`
`186`	`186`	`}`
`187`	`187`
	`188`	`+ $updatable = $updatable && $this->permissionManager->userCanEdit($owneruid);`
	`189`	`+`
`188`	`190`	`$serverHost = $this->urlGenerator->getAbsoluteURL('/');`
`189`	`191`
`190`	`192`	`return $this->wopiMapper->generateFileToken(`