From 93baeac8a4d87d5ca50103aad5ee9e65b6e13fc8 Mon Sep 17 00:00:00 2001
From: "mummert.media" <juergen@mummert.media>
Date: Tue, 27 Oct 2026 20:12:37 +0100
Subject: [PATCH] Hide the inbox edit button without access to the bookings or
 inquiries module

The button leads into the modules Anmeldungen and Kontaktanfragen. A group
that has those modules hidden got a 403 when clicking it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 contao/templates/backend/wk_sync/inbox.html.twig | 4 +++-
 src/Backend/WkSyncBackend.php                    | 9 ++++++++-
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/contao/templates/backend/wk_sync/inbox.html.twig b/contao/templates/backend/wk_sync/inbox.html.twig
index 6bda421..90f2376 100644
--- a/contao/templates/backend/wk_sync/inbox.html.twig
+++ b/contao/templates/backend/wk_sync/inbox.html.twig
@@ -60,7 +60,9 @@
                                 {% for line in item.dataLines %}{{ line|nl2br }}{% if not loop.last %}<br>{% endif %}{% endfor %}
                             </td>
                             <td class="tl_file_list tl_right_nowrap wk-sync-col-actions">
-                                <a href="{{ row.edit_url }}" class="wk-sync-action" title="{{ 'MSC.wk_sync.inbox.edit'|trans }}">{{ 'MSC.wk_sync.inbox.edit'|trans }}</a>
+                                {% if row.edit_url %}
+                                    <a href="{{ row.edit_url }}" class="wk-sync-action" title="{{ 'MSC.wk_sync.inbox.edit'|trans }}">{{ 'MSC.wk_sync.inbox.edit'|trans }}</a>
+                                {% endif %}
                                 {% for target in row.targets %}
                                     <button type="submit" form="wk-sync-single-{{ item.type }}-{{ item.id }}" name="target" value="{{ target.value }}" class="wk-sync-action wk-sync-action--{{ target.translationKey }}" title="{{ ('MSC.wk_sync.inbox.move_to'|trans([('MSC.wk_sync.state.' ~ target.translationKey)|trans])) }}">{{ ('MSC.wk_sync.state.' ~ target.translationKey)|trans }}</button>
                                 {% endfor %}
diff --git a/src/Backend/WkSyncBackend.php b/src/Backend/WkSyncBackend.php
index 2c26901..3cc83ed 100644
--- a/src/Backend/WkSyncBackend.php
+++ b/src/Backend/WkSyncBackend.php
@@ -13,6 +13,7 @@ use Contao\CoreBundle\Exception\RedirectResponseException;
 use Contao\CoreBundle\Exception\ResponseException;
 use Contao\CoreBundle\Framework\Adapter;
 use Contao\CoreBundle\Framework\ContaoFramework;
+use Contao\CoreBundle\Security\ContaoCorePermissions;
 use Contao\Date;
 use Contao\Message;
 use Contao\StringUtil;
@@ -223,12 +224,18 @@ class WkSyncBackend
         $items = $this->inbox->findByState($state, $state->isFinal() ? 300 : 0);
         $referer = (string) $request->attributes->get('_contao_referer_id', '');
 
+        // „Bearbeiten“ führt in die Module Anmeldungen/Kontaktanfragen; ohne Zugriff darauf gäbe es einen 403, also kein Button
+        $canEdit = [
+            true => $this->security->isGranted(ContaoCorePermissions::USER_CAN_ACCESS_MODULE, self::MODULE_BOOKINGS),
+            false => $this->security->isGranted(ContaoCorePermissions::USER_CAN_ACCESS_MODULE, self::MODULE_INQUIRIES),
+        ];
+
         $decorated = [];
 
         foreach ($items as $item) {
             $decorated[] = [
                 'item' => $item,
-                'edit_url' => $this->editUrl($item, $referer),
+                'edit_url' => $canEdit[$item->isBooking()] ? $this->editUrl($item, $referer) : '',
                 'targets' => $state->moveTargets(),
             ];
         }