From bc57f94d5730c1c1e470a52d3d585b69bf57c10e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alexander=20Rie=C3=9F?= Date: Tue, 8 Sep 2026 13:49:57 +0200 Subject: [PATCH] Use the right supplied user object to validate permissions The `getCspForUser()` method is supplied with a user instance, but this implementation always checked permissions against the currently logged in user. This distinction doesn't matter right now, since icingaweb is only ever given the current user, but we shouldn't rely on that. --- library/Feeds/ProvidedHook/Csp.php | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/library/Feeds/ProvidedHook/Csp.php b/library/Feeds/ProvidedHook/Csp.php index b93d81d..495a2a0 100644 --- a/library/Feeds/ProvidedHook/Csp.php +++ b/library/Feeds/ProvidedHook/Csp.php @@ -3,7 +3,6 @@ namespace Icinga\Module\Feeds\ProvidedHook; use Icinga\Application\Hook\CspHook; -use Icinga\Authentication\Auth; use Icinga\Module\Feeds\Storage\StorageFactory; use Icinga\User; use ipl\Web\Common\Csp as CspInstance; @@ -32,7 +31,7 @@ public function getCspForAllUsers(): CspInstance public function getCspForUser(User $user): CspInstance { - if (Auth::getInstance()->hasPermission('feeds/view')) { + if ($user->can('feeds/view')) { return $this->getCspForAllUsers(); }