fix: check each event's monitor when editing event details

actions/eventdetail.php checked only the global Events=Edit permission and
then updated the Name, Cause and Notes of every id in markEids, so a user
denied some monitors could rewrite those monitors' events. The event detail
modal likewise showed the name, cause and notes of any event id it was given.

Load each event and require $event->canEdit(), which adds the per-monitor
view check, as archiving and unarchiving in actions/events.php already do.
The action skips events that fail it; the modal leaves them out, and shows
nothing for a single event that fails.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/ajax/modals/eventdetail.php

@@ -11,8 +11,16 @@ $null = '';
   
 if ( !canEdit('Events') ) return;
 
+// Only events the user may edit: Events=Edit alone isn't enough, the event's
+// monitor has to be one they may see.
+function eventDetailEditable($eid) {
+  $event = new ZM\Event($eid);
+  return $event->Id() and $event->canEdit();
+}
+
 if ( $eid ){ // Single Event Mode
   $eid = validInt($eid);
+  if (!eventDetailEditable($eid)) return;
   $title = translate('Event').' '.$eid.PHP_EOL;
   $inputs .= '<input type="hidden" name="markEids[]" value="' .$eid. '"/>';
   $newEvent = dbFetchOne('SELECT E.* FROM Events AS E WHERE E.Id = ?', NULL, array($eid));
@@ -25,11 +33,13 @@ if ( $eid ){ // Single Event Mode
   $sqlValues = array();
   foreach ( $eids as $eid ) {
     $eid = validInt($eid);
+    if (!eventDetailEditable($eid)) continue;
     $inputs .= '<input type="hidden" name="markEids[]" value="' .$eid. '"/>';
     $sqlWhere[] = 'E.Id = ?';
     $sqlValues[] = $eid;
   }
   unset($eid);
+  if (!count($sqlWhere)) return;
   $sql .= join(' OR ', $sqlWhere);
   foreach( dbFetchAll( $sql, NULL, $sqlValues ) as $row ) {
     if ( !isset($newEvent) ) {

web/includes/actions/eventdetail.php

@@ -32,12 +32,19 @@ if ( !canEdit('Events') ) {
 if ( $action == 'eventdetail' ) {
   $dbConn->beginTransaction();
   foreach ( $_REQUEST['markEids'] as $markEid ) {
+    // Events=Edit alone isn't enough: the event's monitor has to be one the user
+    // may see, as for archiving in actions/events.php.
+    $event = new ZM\Event(validInt($markEid));
+    if (!$event->Id() or !$event->canEdit()) {
+      ZM\Warning('No permission to edit event '.validInt($markEid));
+      continue;
+    }
     dbQuery('UPDATE Events SET Name=?, Cause=?, Notes=? WHERE Id=?',
       array(
         $_REQUEST['newEvent']['Name'],
         $_REQUEST['newEvent']['Cause'],
         $_REQUEST['newEvent']['Notes'],
-        $markEid
+        $event->Id()
       )
     );
   }