[Security] Hackzilla\Bundle\TicketBundle\Manager::hasPermission() result is ignored, meaning permissions are not checked and operation is always allowed #263
Hackzilla\Bundle\TicketBundle\Manager::hasPermission() returns a boolean, but calls to that function do not attempt to use its result.
They probably call it expecting it will throw an exception if access should not be granted (e.g. here), but it won't because said exception is caught and the function returns false instead.
Hackzilla\Bundle\TicketBundle\Manager::hasPermission()
returns a boolean, but calls to that function do not attempt to use its result. They probably call it expecting it will throw an exception if access should not be granted (e.g. here), but it won't because said exception is caught and the function returns false instead.