Security: REST dispatch endpoint missing ACL check #109

New Issue

2026-06-06T11:50:07Z

jmiller commented

2026-06-06 11:50:07 +00:00

Audit Finding

Severity: High

Issue:
DispatchController::dispatch() does not verify core.manage permission. Any API-authenticated user can trigger cross-posts for any article.

Fix: Add ACL check after method check.

Files: DispatchController.php

## Audit Finding **Severity:** High **Issue:** `DispatchController::dispatch()` does not verify `core.manage` permission. Any API-authenticated user can trigger cross-posts for any article. **Fix:** Add ACL check after method check. **Files:** `DispatchController.php`

jmiller commented

2026-06-06 11:50:10 +00:00

Branch created: feature/109-security-rest-dispatch-endpoint-missing-

git fetch origin
git checkout feature/109-security-rest-dispatch-endpoint-missing-

Branch created: [`feature/109-security-rest-dispatch-endpoint-missing-`](https://git.mokoconsulting.tech/MokoConsulting/MokoJoomCross/src/branch/feature/109-security-rest-dispatch-endpoint-missing-) ```bash git fetch origin git checkout feature/109-security-rest-dispatch-endpoint-missing- ```

jmiller referenced this issue from a commit

2026-06-06 14:33:22 +00:00

security: fix 9 security and critical bugs (#107-#115, #120)

jmiller closed this issue

2026-06-06 14:35:08 +00:00

Sign in to join this conversation.

Priority -

Type —

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoJoomCross#109