45898: Wiki: Unauthorized Access to LTI Settings

Signed-off-by: Releasemanager <webmaster@ilias.de>

Author: alex40724

Modules/Wiki/classes/class.ilObjWikiGUI.php

@@ -183,8 +183,6 @@ public function executeCommand(): void
                 }
 
                 // alter title and description
-                //				$tpl->setTitle($wpage_gui->getPageObject()->getTitle());
-                //				$tpl->setDescription($this->object->getTitle());
                 if ($ilAccess->checkAccess("write", "", $this->object->getRefId())) {
                     $wpage_gui->activateMetaDataEditor($this->object, "wpg", $wpage_gui->getId());
                 }
@@ -279,6 +277,7 @@ public function executeCommand(): void
                 break;
 
             case 'ilrepositoryobjectsearchgui':
+                $this->checkPermission("read");
                 $this->addHeaderAction();
                 $this->setSideBlock();
                 $ilTabs->setTabActive("wiki_search_results");
@@ -294,6 +293,7 @@ public function executeCommand(): void
                 break;
 
             case 'ilobjnotificationsettingsgui':
+                $this->checkPermission("write");
                 $this->addHeaderAction();
                 $ilTabs->activateTab("settings");
                 $this->setSettingsSubTabs("notifications");
@@ -302,6 +302,7 @@ public function executeCommand(): void
                 break;
 
             case 'illtiproviderobjectsettinggui':
+                $this->checkPermission("write");
                 $this->addHeaderAction();
                 $ilTabs->activateTab("settings");
                 $this->setSettingsSubTabs("lti_provider");