[API] Using isAccessibleBy on candidate endpoint (#8824)

Add accessibility check for candidate metadata, not just visits.
aces · Jul 4, 2023 · f8f123d · f8f123d
1 parent c521659
commit f8f123d
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/modules/api/php/endpoints/candidates.class.inc b/modules/api/php/endpoints/candidates.class.inc
@@ -150,6 +150,10 @@ class Candidates extends Endpoint implements \LORIS\Middleware\ETagCalculator
 
         $candidate = \NDB_Factory::singleton()->candidate($candID);
 
+        if (!$candidate->isAccessibleBy($user)) {
+            return new \LORIS\Http\Response\JSON\Forbidden();
+        }
+
         $endpoint = new Candidate\Candidate($candidate);
 
         $pathparts = array_slice($pathparts, 2);