From ce0b500d7a4fd7e6b0f7a557d39591de3439e510 Mon Sep 17 00:00:00 2001 From: Bastian Wagner Date: Tue, 4 Aug 2026 08:59:49 +0200 Subject: [PATCH] fix: re-check canBook() inside export dialog methods (defense in depth) openExportDialog()/openExportSubscriptionDialog() only guarded on teamId truthiness, relying solely on the template @if for permission gating. Every other permission-gated method in Cashbox (submitPlayerBooking, reverseBooking) re-checks the permission internally too. Add the same guard here, plus a test asserting direct invocation without booking rights does not call dialog.open. --- .../src/app/features/team/cashbox/cashbox.spec.ts | 9 +++++++++ .../src/app/features/team/cashbox/cashbox.ts | 4 ++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/myteamwallet_frontend_modern/src/app/features/team/cashbox/cashbox.spec.ts b/myteamwallet_frontend_modern/src/app/features/team/cashbox/cashbox.spec.ts index 39d194c..d2e7063 100644 --- a/myteamwallet_frontend_modern/src/app/features/team/cashbox/cashbox.spec.ts +++ b/myteamwallet_frontend_modern/src/app/features/team/cashbox/cashbox.spec.ts @@ -306,4 +306,13 @@ describe('Cashbox', () => { ); expect(exportButton).toBeUndefined(); }); + + it('does not open the export dialogs when invoked directly without booking rights', async () => { + const { component, dialog } = await setup(1); + + component['openExportDialog'](); + component['openExportSubscriptionDialog'](); + + expect(dialog.open).not.toHaveBeenCalled(); + }); }); diff --git a/myteamwallet_frontend_modern/src/app/features/team/cashbox/cashbox.ts b/myteamwallet_frontend_modern/src/app/features/team/cashbox/cashbox.ts index 18a0947..ff4f310 100644 --- a/myteamwallet_frontend_modern/src/app/features/team/cashbox/cashbox.ts +++ b/myteamwallet_frontend_modern/src/app/features/team/cashbox/cashbox.ts @@ -402,13 +402,13 @@ export class Cashbox { protected openExportDialog(): void { const teamId = this.team()?.id; - if (!teamId) return; + if (!this.canBook() || !teamId) return; this.dialog.open(CashboxExportDialog, { data: { teamId } }); } protected openExportSubscriptionDialog(): void { const teamId = this.team()?.id; - if (!teamId) return; + if (!this.canBook() || !teamId) return; this.dialog.open(CashboxExportSubscriptionDialog, { data: { teamId } }); }