fix: corrected and improved permission checks

thorsten · thorsten · commit 23b48ee430ca · 2026-04-10T09:59:48.000+02:00
diff --git a/phpmyfaq/admin/assets/src/api/tags.test.ts b/phpmyfaq/admin/assets/src/api/tags.test.ts
@@ -55,14 +55,16 @@ describe('Tags API', () => {
       );
 
       const tagId = '1';
-      await deleteTag(tagId);
+      const csrfToken = 'test-csrf';
+      await deleteTag(tagId, csrfToken);
 
       expect(global.fetch).toHaveBeenCalledWith('./api/content/tags/1', {
         method: 'DELETE',
         cache: 'no-cache',
         headers: {
           'Content-Type': 'application/json',
         },
+        body: JSON.stringify({ csrfToken: 'test-csrf' }),
         redirect: 'follow',
         referrerPolicy: 'no-referrer',
       });
@@ -73,8 +75,9 @@ describe('Tags API', () => {
       global.fetch = vi.fn(() => Promise.reject(mockError));
 
       const tagId = '1';
+      const csrfToken = 'test-csrf';
 
-      await expect(deleteTag(tagId)).rejects.toThrow(mockError);
+      await expect(deleteTag(tagId, csrfToken)).rejects.toThrow(mockError);
     });
   });
 });
diff --git a/phpmyfaq/admin/assets/src/api/tags.ts b/phpmyfaq/admin/assets/src/api/tags.ts
@@ -27,13 +27,14 @@ export const fetchTags = async (searchString: string): Promise<unknown> => {
   });
 };
 
-export const deleteTag = async (tagId: string): Promise<unknown> => {
+export const deleteTag = async (tagId: string, csrfToken: string): Promise<unknown> => {
   return await fetchJson(`./api/content/tags/${tagId}`, {
     method: 'DELETE',
     cache: 'no-cache',
     headers: {
       'Content-Type': 'application/json',
     },
+    body: JSON.stringify({ csrfToken: csrfToken }),
     redirect: 'follow',
     referrerPolicy: 'no-referrer',
   });
diff --git a/phpmyfaq/admin/assets/src/content/tags.test.ts b/phpmyfaq/admin/assets/src/content/tags.test.ts
@@ -85,6 +85,7 @@ describe('handleTags', () => {
   describe('delete button', () => {
     const setupDeleteDom = () => {
       document.body.innerHTML = `
+        <input name="pmf-csrf-token" value="test-csrf" />
         <table>
           <tbody>
             <tr id="pmf-row-tag-id-1">
@@ -112,7 +113,7 @@ describe('handleTags', () => {
 
       await new Promise((resolve) => setTimeout(resolve, 10));
 
-      expect(deleteTag).toHaveBeenCalledWith('1');
+      expect(deleteTag).toHaveBeenCalledWith('1', 'test-csrf');
       expect(pushNotification).toHaveBeenCalledWith('Tag deleted successfully');
 
       const row = document.getElementById('pmf-row-tag-id-1');
@@ -133,7 +134,7 @@ describe('handleTags', () => {
 
       await new Promise((resolve) => setTimeout(resolve, 10));
 
-      expect(deleteTag).toHaveBeenCalledWith('1');
+      expect(deleteTag).toHaveBeenCalledWith('1', 'test-csrf');
       expect(consoleErrorSpy).toHaveBeenCalledWith('Network response was not ok:', 'Tag deletion failed');
 
       // Row should still be present
diff --git a/phpmyfaq/admin/assets/src/content/tags.ts b/phpmyfaq/admin/assets/src/content/tags.ts
@@ -73,8 +73,9 @@ export const handleTags = (): void => {
       element.addEventListener('click', async (event: Event) => {
         const target = event.target as HTMLElement;
         const tagId = target.getAttribute('data-pmf-id') as string;
+        const csrfToken = (document.querySelector('input[name=pmf-csrf-token]') as HTMLInputElement).value;
 
-        const response = (await deleteTag(tagId)) as DeleteTagResponse;
+        const response = (await deleteTag(tagId, csrfToken)) as DeleteTagResponse;
         if (response.success) {
           pushNotification(response.success);
           const row = document.getElementById(`pmf-row-tag-id-${tagId}`) as HTMLElement;
diff --git a/phpmyfaq/assets/templates/admin/configuration/instances.edit.twig b/phpmyfaq/assets/templates/admin/configuration/instances.edit.twig
@@ -9,6 +9,7 @@
     </h1>
   </div>
   <form action="./instance/update" method="post" accept-charset="utf-8">
+    <input type="hidden" name="pmf-csrf-token" value="{{ csrfTokenUpdateInstance }}"/>
     <input type="hidden" name="id" value="{{ instance.id }}"/>
     <div class="row mb-2">
       <label for="url" class="col-lg-2 col-form-label">{{ ad_instance_url }}:</label>
diff --git a/phpmyfaq/assets/templates/admin/user/group.twig b/phpmyfaq/assets/templates/admin/user/group.twig
@@ -46,6 +46,7 @@
           <i class="bi bi-info-circle" aria-hidden="true"></i> {{ 'ad_group_details' | translate }}
         </h5>
         <form action="./group/update" method="post">
+          <input type="hidden" name="pmf-csrf-token" value="{{ csrfTokenUpdateGroup }}">
           <input id="update_group_id" type="hidden" name="group_id" value="0">
           <div class="card-body">
             <div class="row mb-2">
@@ -91,6 +92,7 @@
 
     <div class="col-lg-4" id="groupMemberships">
       <form id="group_membership" name="group_membership" method="post" action="./group/update/members">
+        <input type="hidden" name="pmf-csrf-token" value="{{ csrfTokenUpdateGroupMembers }}">
         <input id="update_member_group_id" type="hidden" name="group_id" value="0">
         <div class="card shadow mb-4">
           <h5 class="card-header py-3">
@@ -170,6 +172,7 @@
 
       <div id="groupRights" class="card shadow mb-4">
         <form id="rightsForm" action="./group/update/permissions" method="post">
+          <input type="hidden" name="pmf-csrf-token" value="{{ csrfTokenUpdateGroupPermissions }}">
           <input id="rights_group_id" type="hidden" name="group_id" value="0">
           <h5 class="card-header py-3" id="user_rights_legend">
             <i aria-hidden="true" class="bi bi-lock"></i> {{ 'ad_group_rights' | translate }}
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/AbstractController.php b/phpmyfaq/src/phpMyFAQ/Controller/AbstractController.php
@@ -255,7 +255,7 @@ private function isPublicAuthenticationPath(string $pathInfo): bool
     /**
      * @throws UnauthorizedHttpException
      */
-    protected function userIsAuthenticated(): void
+    public function userIsAuthenticated(): void
     {
         if (!$this->currentUser->isLoggedIn()) {
             throw new UnauthorizedHttpException(challenge: 'User is not authenticated.');
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/AdminLogController.php b/phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/AdminLogController.php
@@ -41,7 +41,7 @@ final class AdminLogController extends AbstractAdministrationApiController
     #[Route(path: 'statistics/admin-log', name: 'admin.api.statistics.admin-log.delete', methods: ['DELETE'])]
     public function delete(Request $request): JsonResponse
     {
-        $this->userHasPermission(PermissionType::STATISTICS_VIEWLOGS);
+        $this->userHasPermission(PermissionType::STATISTICS_ADMINLOG);
 
         $data = json_decode($request->getContent(), associative: false, depth: 512, flags: JSON_THROW_ON_ERROR);
 
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/CategoryController.php b/phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/CategoryController.php
@@ -107,7 +107,7 @@ public function delete(Request $request): JsonResponse
     #[Route(path: 'category/permissions', name: 'admin.api.category.permissions', methods: ['GET'])]
     public function permissions(Request $request): JsonResponse
     {
-        $this->userIsAuthenticated();
+        $this->userHasPermission(PermissionType::CATEGORY_EDIT);
 
         $categoryData = $request->attributes->get('categories');
 
@@ -132,7 +132,7 @@ public function permissions(Request $request): JsonResponse
     #[Route(path: 'category/translations', name: 'admin.api.category.translations', methods: ['GET'])]
     public function translations(Request $request): JsonResponse
     {
-        $this->userIsAuthenticated();
+        $this->userHasPermission(PermissionType::CATEGORY_EDIT);
 
         $category = new Category($this->configuration, [], false);
 
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/ConfigurationTabController.php b/phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/ConfigurationTabController.php
@@ -479,7 +479,7 @@ public function seoMetaTags(Request $request): Response
     )]
     public function translationProvider(Request $request): Response
     {
-        $this->userIsAuthenticated();
+        $this->userHasPermission(PermissionType::CONFIGURATION_EDIT);
 
         return new Response(AdminMenuBuilder::renderTranslationProviderOptions($request->attributes->get(
             key: 'current',
@@ -493,7 +493,7 @@ public function translationProvider(Request $request): Response
     )]
     public function mailProvider(Request $request): Response
     {
-        $this->userIsAuthenticated();
+        $this->userHasPermission(PermissionType::CONFIGURATION_EDIT);
 
         return new Response(AdminMenuBuilder::renderMailProviderOptions($request->attributes->get(key: 'current')));
     }
@@ -505,7 +505,7 @@ public function mailProvider(Request $request): Response
     )]
     public function cacheAdapter(Request $request): Response
     {
-        $this->userIsAuthenticated();
+        $this->userHasPermission(PermissionType::CONFIGURATION_EDIT);
 
         return new Response(AdminMenuBuilder::renderCacheAdapterOptions($request->attributes->get(key: 'current')));
     }
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/MarkdownController.php b/phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/MarkdownController.php
@@ -19,30 +19,34 @@
 
 namespace phpMyFAQ\Controller\Administration\Api;
 
+use Exception;
 use League\CommonMark\Environment\Environment;
 use League\CommonMark\Exception\CommonMarkException;
 use League\CommonMark\Extension\CommonMark\CommonMarkCoreExtension;
 use League\CommonMark\Extension\GithubFlavoredMarkdownExtension;
 use League\CommonMark\MarkdownConverter;
-use phpMyFAQ\Controller\AbstractController;
+use phpMyFAQ\Enums\PermissionType;
 use phpMyFAQ\Filter;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
 
-final class MarkdownController extends AbstractController
+final class MarkdownController extends AbstractAdministrationApiController
 {
     /**
      * @throws CommonMarkException
+     * @throws Exception
      */
     #[Route(path: 'content/markdown', name: 'admin.api.content.markdown', methods: ['POST'])]
     public function renderMarkdown(Request $request): JsonResponse
     {
+        $this->userHasPermission(PermissionType::FAQ_EDIT);
+
         $data = json_decode($request->getContent());
 
         if (!is_object($data) || !property_exists($data, 'text')) {
-            throw new \Exception('Invalid JSON data');
+            throw new Exception('Invalid JSON data');
         }
 
         $answer = Filter::filterVar($data->text, FILTER_SANITIZE_SPECIAL_CHARS);
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/NewsController.php b/phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/NewsController.php
@@ -117,7 +117,7 @@ public function delete(Request $request): JsonResponse
     #[Route(path: 'news/update', name: 'admin.api.news.update', methods: ['PUT'])]
     public function update(Request $request): JsonResponse
     {
-        $this->userHasPermission(PermissionType::NEWS_DELETE);
+        $this->userHasPermission(PermissionType::NEWS_EDIT);
 
         $data = json_decode($request->getContent());
 
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/TagController.php b/phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/TagController.php
@@ -123,6 +123,12 @@ public function delete(Request $request): JsonResponse
     {
         $this->userHasPermission(PermissionType::FAQ_EDIT);
 
+        $data = json_decode($request->getContent());
+
+        if (!Token::getInstance($this->session)->verifyToken('tags', $data->csrfToken ?? '')) {
+            return $this->json(['error' => Translation::get(key: 'msgNoPermission')], Response::HTTP_UNAUTHORIZED);
+        }
+
         $tagId = (int) Filter::filterVar($request->attributes->get('tagId'), FILTER_VALIDATE_INT);
 
         if ($this->tags->delete($tagId)) {
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/Administration/AuthenticationController.php b/phpmyfaq/src/phpMyFAQ/Controller/Administration/AuthenticationController.php
@@ -33,7 +33,7 @@
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
 
-final class AuthenticationController extends AbstractAdministrationController
+final class AuthenticationController extends AbstractAdministrationController implements SkipsAuthenticationCheck
 {
     public function __construct(
         private readonly CurrentUser $currentUserService,
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/Administration/GroupController.php b/phpmyfaq/src/phpMyFAQ/Controller/Administration/GroupController.php
@@ -205,6 +205,11 @@ public function update(Request $request): Response
     {
         $this->userHasPermission(PermissionType::GROUP_EDIT);
 
+        $csrfToken = Filter::filterVar($request->request->get('pmf-csrf-token'), FILTER_SANITIZE_SPECIAL_CHARS);
+        if (!Token::getInstance($this->session)->verifyToken('update-group', $csrfToken)) {
+            throw new UnauthorizedHttpException('Invalid CSRF token');
+        }
+
         $groupId = (int) Filter::filterVar($request->request->get('group_id'), FILTER_VALIDATE_INT);
 
         $groupData = [];
@@ -257,6 +262,11 @@ public function updateMembers(Request $request): Response
     {
         $this->userHasPermission(PermissionType::GROUP_EDIT);
 
+        $csrfToken = Filter::filterVar($request->request->get('pmf-csrf-token'), FILTER_SANITIZE_SPECIAL_CHARS);
+        if (!Token::getInstance($this->session)->verifyToken('update-group-members', $csrfToken)) {
+            throw new UnauthorizedHttpException('Invalid CSRF token');
+        }
+
         $groupId = (int) Filter::filterVar($request->request->get('group_id'), FILTER_VALIDATE_INT);
         $groupMembers = $request->request->all()['group_members'];
 
@@ -300,6 +310,11 @@ public function updatePermissions(Request $request): Response
     {
         $this->userHasPermission(PermissionType::GROUP_EDIT);
 
+        $csrfToken = Filter::filterVar($request->request->get('pmf-csrf-token'), FILTER_SANITIZE_SPECIAL_CHARS);
+        if (!Token::getInstance($this->session)->verifyToken('update-group-permissions', $csrfToken)) {
+            throw new UnauthorizedHttpException('Invalid CSRF token');
+        }
+
         $groupId = (int) Filter::filterVar($request->request->get('group_id'), FILTER_VALIDATE_INT);
         $groupPermissions = $request->request->all()['group_rights'];
 
@@ -341,6 +356,11 @@ private function getBaseTemplateVars(): array
     {
         return [
             'rightData' => $this->user->perm->getAllRightsData(),
+            'csrfTokenUpdateGroup' => Token::getInstance($this->session)->getTokenString('update-group'),
+            'csrfTokenUpdateGroupMembers' => Token::getInstance($this->session)->getTokenString('update-group-members'),
+            'csrfTokenUpdateGroupPermissions' => Token::getInstance($this->session)->getTokenString(
+                'update-group-permissions',
+            ),
         ];
     }
 }
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/Administration/InstanceController.php b/phpmyfaq/src/phpMyFAQ/Controller/Administration/InstanceController.php
@@ -30,6 +30,7 @@
 use phpMyFAQ\Translation;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Exception\UnauthorizedHttpException;
 use Symfony\Component\Routing\Attribute\Route;
 use Twig\Error\LoaderError;
 
@@ -85,6 +86,7 @@ public function edit(Request $request): Response
             'ad_instance_config' => Translation::get(key: 'ad_instance_config'),
             'ad_entry_back' => Translation::get(key: 'ad_entry_back'),
             'instance' => $instanceData,
+            'csrfTokenUpdateInstance' => Token::getInstance($this->session)->getTokenString('update-instance'),
         ]);
     }
 
@@ -98,6 +100,11 @@ public function update(Request $request): Response
     {
         $this->userHasPermission(PermissionType::INSTANCE_EDIT);
 
+        $csrfToken = Filter::filterVar($request->request->get('pmf-csrf-token'), FILTER_SANITIZE_SPECIAL_CHARS);
+        if (!Token::getInstance($this->session)->verifyToken('update-instance', $csrfToken)) {
+            throw new UnauthorizedHttpException('Invalid CSRF token');
+        }
+
         $instanceId = (int) Filter::filterVar($request->attributes->get('id'), FILTER_VALIDATE_INT);
 
         $fileSystem = new Filesystem(PMF_ROOT_DIR);
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/Administration/PluginController.php b/phpmyfaq/src/phpMyFAQ/Controller/Administration/PluginController.php
@@ -20,6 +20,7 @@
 namespace phpMyFAQ\Controller\Administration;
 
 use phpMyFAQ\Core\Exception;
+use phpMyFAQ\Enums\PermissionType;
 use phpMyFAQ\Plugin\PluginManager;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
@@ -42,6 +43,8 @@ public function __construct(
     #[Route(path: '/plugins', name: 'admin.configuration.plugins', methods: ['GET'])]
     public function index(Request $request): Response
     {
+        $this->userHasPermission(PermissionType::CONFIGURATION_EDIT);
+
         $pluginManager = $this->pluginManager;
         $pluginManager->loadPlugins();
 
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/Administration/SkipsAuthenticationCheck.php b/phpmyfaq/src/phpMyFAQ/Controller/Administration/SkipsAuthenticationCheck.php
@@ -0,0 +1,28 @@
+<?php
+
+/**
+ * Marker interface for admin controllers that intentionally bypass the
+ * automatic authentication enforcement performed by the
+ * ControllerContainerListener.
+ *
+ * Only the AuthenticationController itself (handling login/logout/token
+ * endpoints) should implement this interface. Every other controller in
+ * the Administration namespace must require an authenticated user.
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public License,
+ * v. 2.0. If a copy of the MPL was not distributed with this file, You can
+ * obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * @package   phpMyFAQ
+ * @author    Thorsten Rinne <thorsten@phpmyfaq.de>
+ * @copyright 2026 phpMyFAQ Team
+ * @license   https://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
+ * @link      https://www.phpmyfaq.de
+ * @since     2026-04-10
+ */
+
+declare(strict_types=1);
+
+namespace phpMyFAQ\Controller\Administration;
+
+interface SkipsAuthenticationCheck {}
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/Administration/TagController.php b/phpmyfaq/src/phpMyFAQ/Controller/Administration/TagController.php
@@ -20,6 +20,7 @@
 namespace phpMyFAQ\Controller\Administration;
 
 use phpMyFAQ\Core\Exception;
+use phpMyFAQ\Enums\PermissionType;
 use phpMyFAQ\Session\Token;
 use phpMyFAQ\Tags;
 use phpMyFAQ\Translation;
@@ -44,7 +45,7 @@ public function __construct(
     #[Route(path: '/tags', name: 'admin.tags', methods: ['GET'])]
     public function index(Request $request): Response
     {
-        $this->userIsAuthenticated();
+        $this->userHasPermission(PermissionType::FAQ_EDIT);
 
         $tagData = $this->tags->getAllTags();
 
diff --git a/phpmyfaq/src/phpMyFAQ/Controller/Administration/UserController.php b/phpmyfaq/src/phpMyFAQ/Controller/Administration/UserController.php
@@ -92,6 +92,10 @@ public function edit(Request $request): Response
     #[Route(path: '/user/list', name: 'admin.user.list', methods: ['GET'])]
     public function list(Request $request): Response
     {
+        $this->userHasPermission(PermissionType::USER_ADD);
+        $this->userHasPermission(PermissionType::USER_DELETE);
+        $this->userHasPermission(PermissionType::USER_EDIT);
+
         $allUsers = $this->user->getAllUsers(false);
         $numUsers = is_countable($allUsers) ? count($allUsers) : 0;
 
diff --git a/phpmyfaq/src/phpMyFAQ/EventListener/ControllerContainerListener.php b/phpmyfaq/src/phpMyFAQ/EventListener/ControllerContainerListener.php
diff --git a/tests/phpMyFAQ/Controller/Administration/Api/MarkdownControllerTest.php b/tests/phpMyFAQ/Controller/Administration/Api/MarkdownControllerTest.php
diff --git a/tests/phpMyFAQ/Controller/Administration/Api/TagControllerTest.php b/tests/phpMyFAQ/Controller/Administration/Api/TagControllerTest.php
diff --git a/tests/phpMyFAQ/Controller/Administration/Fixtures/ListenerAdminFixtureController.php b/tests/phpMyFAQ/Controller/Administration/Fixtures/ListenerAdminFixtureController.php
diff --git a/tests/phpMyFAQ/Controller/Administration/Fixtures/ListenerAuthenticationFixtureController.php b/tests/phpMyFAQ/Controller/Administration/Fixtures/ListenerAuthenticationFixtureController.php
diff --git a/tests/phpMyFAQ/Controller/Administration/GroupControllerTest.php b/tests/phpMyFAQ/Controller/Administration/GroupControllerTest.php
diff --git a/tests/phpMyFAQ/Controller/Administration/InstanceControllerTest.php b/tests/phpMyFAQ/Controller/Administration/InstanceControllerTest.php
diff --git a/tests/phpMyFAQ/EventListener/ControllerContainerListenerTest.php b/tests/phpMyFAQ/EventListener/ControllerContainerListenerTest.php

Original file line number	Diff line number	Diff line change
`@@ -255,7 +255,7 @@ private function isPublicAuthenticationPath(string $pathInfo): bool`
`255`	`255`	`/**`
`256`	`256`	`* @throws UnauthorizedHttpException`
`257`	`257`	`*/`
`258`		`- protected function userIsAuthenticated(): void`
	`258`	`+ public function userIsAuthenticated(): void`
`259`	`259`	`{`
`260`	`260`	`if (!$this->currentUser->isLoggedIn()) {`
`261`	`261`	`throw new UnauthorizedHttpException(challenge: 'User is not authenticated.');`
Original file line number	Diff line number	Diff line change
`@@ -41,7 +41,7 @@ final class AdminLogController extends AbstractAdministrationApiController`
`41`	`41`	`#[Route(path: 'statistics/admin-log', name: 'admin.api.statistics.admin-log.delete', methods: ['DELETE'])]`
`42`	`42`	`public function delete(Request $request): JsonResponse`
`43`	`43`	`{`
`44`		`- $this->userHasPermission(PermissionType::STATISTICS_VIEWLOGS);`
	`44`	`+ $this->userHasPermission(PermissionType::STATISTICS_ADMINLOG);`
`45`	`45`
`46`	`46`	`$data = json_decode($request->getContent(), associative: false, depth: 512, flags: JSON_THROW_ON_ERROR);`
`47`	`47`
Original file line number	Diff line number	Diff line change
`@@ -107,7 +107,7 @@ public function delete(Request $request): JsonResponse`
`107`	`107`	`#[Route(path: 'category/permissions', name: 'admin.api.category.permissions', methods: ['GET'])]`
`108`	`108`	`public function permissions(Request $request): JsonResponse`
`109`	`109`	`{`
`110`		`- $this->userIsAuthenticated();`
	`110`	`+ $this->userHasPermission(PermissionType::CATEGORY_EDIT);`
`111`	`111`
`112`	`112`	`$categoryData = $request->attributes->get('categories');`
`113`	`113`
`@@ -132,7 +132,7 @@ public function permissions(Request $request): JsonResponse`
`132`	`132`	`#[Route(path: 'category/translations', name: 'admin.api.category.translations', methods: ['GET'])]`
`133`	`133`	`public function translations(Request $request): JsonResponse`
`134`	`134`	`{`
`135`		`- $this->userIsAuthenticated();`
	`135`	`+ $this->userHasPermission(PermissionType::CATEGORY_EDIT);`
`136`	`136`
`137`	`137`	`$category = new Category($this->configuration, [], false);`
`138`	`138`
Original file line number	Diff line number	Diff line change
`@@ -479,7 +479,7 @@ public function seoMetaTags(Request $request): Response`
`479`	`479`	`)]`
`480`	`480`	`public function translationProvider(Request $request): Response`
`481`	`481`	`{`
`482`		`- $this->userIsAuthenticated();`
	`482`	`+ $this->userHasPermission(PermissionType::CONFIGURATION_EDIT);`
`483`	`483`
`484`	`484`	`return new Response(AdminMenuBuilder::renderTranslationProviderOptions($request->attributes->get(`
`485`	`485`	`key: 'current',`
`@@ -493,7 +493,7 @@ public function translationProvider(Request $request): Response`
`493`	`493`	`)]`
`494`	`494`	`public function mailProvider(Request $request): Response`
`495`	`495`	`{`
`496`		`- $this->userIsAuthenticated();`
	`496`	`+ $this->userHasPermission(PermissionType::CONFIGURATION_EDIT);`
`497`	`497`
`498`	`498`	`return new Response(AdminMenuBuilder::renderMailProviderOptions($request->attributes->get(key: 'current')));`
`499`	`499`	`}`
`@@ -505,7 +505,7 @@ public function mailProvider(Request $request): Response`
`505`	`505`	`)]`
`506`	`506`	`public function cacheAdapter(Request $request): Response`
`507`	`507`	`{`
`508`		`- $this->userIsAuthenticated();`
	`508`	`+ $this->userHasPermission(PermissionType::CONFIGURATION_EDIT);`
`509`	`509`
`510`	`510`	`return new Response(AdminMenuBuilder::renderCacheAdapterOptions($request->attributes->get(key: 'current')));`
`511`	`511`	`}`