Fix: improper access (#523)

pimcore · Jan 8, 2024 · c33c004 · c33c004
1 parent 449a620
commit c33c004
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/src/Controller/Admin/DuplicatesController.php b/src/Controller/Admin/DuplicatesController.php
@@ -23,6 +23,7 @@
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Event\ControllerEvent;
 use Symfony\Component\Routing\Annotation\Route;
 
 /**
@@ -35,6 +36,12 @@ public function init()
         AbstractObject::setHideUnpublished(true);
     }
 
+    public function onKernelControllerEvent(ControllerEvent $event): void
+    {
+        parent::onKernelControllerEvent($event);
+        $this->checkPermission('plugin_cmf_perm_customerview');
+    }
+
     /**
      * @Route("/list")
      *