Isaac Connor bbb03d2d05 fix: use method call for System permission check in ConfigsController ...

The config-api RCE fix (b036408a5) guards edit() and delete() with
($user['System'] == 'Edit'), but $user is a ZM\User object that does
not implement ArrayAccess and whose System property is protected. Array
access on it raises "Error: Cannot use object of type ZM\User as array",
so the endpoint fatals with HTTP 500 for every authenticated user. This
blocks the RCE only by accident and also breaks config editing for
legitimate System=Edit admins.

Use $user->System(), matching the idiom in every other API controller
(States, Servers, Monitors, Users, etc.).

Refs GHSA-mvj8-mqqq-2w5f.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 2f57a4f606)

2026-07-19 16:23:22 -04:00

4.8 KiB

Raw Blame History

View Raw