From 01f35a4cc7cbe7136cbfdd379171b033dab6d1be Mon Sep 17 00:00:00 2001 From: Daniel Subiabre Date: Tue, 25 Feb 2025 14:49:09 +0100 Subject: [PATCH] Fix user api resource edit security --- src/ApiResource/User/UserApiResource.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/ApiResource/User/UserApiResource.php b/src/ApiResource/User/UserApiResource.php index a16940c..5e4798d 100644 --- a/src/ApiResource/User/UserApiResource.php +++ b/src/ApiResource/User/UserApiResource.php @@ -29,8 +29,8 @@ use Symfony\Component\Validator\Constraints as Assert; #[API\GetCollection()] #[API\Post(input: UserSignupDto::class, processor: UserSignupProcessor::class)] #[API\Get()] -#[API\Patch(securityPostDenormalize: 'is_granted("USER_EDIT", object)')] -#[API\Delete(securityPostDenormalize: 'is_granted("USER_EDIT", object)')] +#[API\Patch(securityPostDenormalize: 'is_granted("USER_EDIT", previous_object)')] +#[API\Delete(securityPostDenormalize: 'is_granted("USER_EDIT", previous_object)')] #[API\ApiFilter(filterClass: UserQueryFilter::class, properties: ['query'])] class UserApiResource { @@ -59,7 +59,7 @@ class UserApiResource /** * Is this User for an individual acting on their own or a group of individuals? */ - #[API\ApiProperty(securityPostDenormalize: 'is_granted("USER_EDIT")')] + #[API\ApiProperty(securityPostDenormalize: 'is_granted("USER_EDIT", previous_object)')] public UserType $type; /**