Merge branch '1.0'

uvdesk · Jul 20, 2021 · 5cf2eeb · 5cf2eeb
2 parents 1432fa2 + b8c964c
commit 5cf2eeb
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/Controller/Ticket.php b/Controller/Ticket.php
@@ -509,6 +509,12 @@ public function downloadAttachmentZip(Request $request)
             $this->noResultFound();
         }
 
+        $ticket = $attachment->getThread()->getTicket();
+        // Proceed only if user has access to the resource
+        if (false == $this->ticketService->isTicketAccessGranted($ticket)) {
+            throw new \Exception('Access Denied', 403);
+        }
+
         $zipname = 'attachments/' .$threadId.'.zip';
         $zip = new \ZipArchive;
 
@@ -540,6 +546,12 @@ public function downloadAttachment(Request $request)
             $this->noResultFound();
         }
 
+        $ticket = $attachment->getThread()->getTicket();
+        // Proceed only if user has access to the resource
+        if (false == $this->ticketService->isTicketAccessGranted($ticket, $user)) {
+            throw new \Exception('Access Denied', 403);
+        }
+
         $path = $this->get('kernel')->getProjectDir() . "/public/". $attachment->getPath();
 
         $response = new Response();