fix logs client

front/dropdown_host.ajax.php

@@ -11,6 +11,7 @@ declare(strict_types=1);
  */
 
 use GlpiPlugin\Urbackup\Config;
+use GlpiPlugin\Urbackup\Profile;
 
 if (!defined('GLPI_ROOT')) {
     define('GLPI_ROOT', dirname(__DIR__, 4));
@@ -22,6 +23,11 @@ Html::header_nocache();
 
 Session::checkLoginUser();
 
+if (!Profile::canCurrentUser(READ)) {
+    http_response_code(403);
+    exit;
+}
+
 if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'GET') {
     http_response_code(405);
     exit;

front/server_test.ajax.php

@@ -10,7 +10,6 @@ declare(strict_types=1);
  * only accepts POST requests (GET requests must not trigger state changes).
  */
 
-use GlpiPlugin\Urbackup\Profile;
 use GlpiPlugin\Urbackup\Server;
 use GlpiPlugin\Urbackup\UrbackupApiClient;
 
@@ -31,12 +30,6 @@ if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST') {
     exit;
 }
 
-if (!Profile::canCurrentUser(UPDATE)) {
-    http_response_code(403);
-    echo json_encode(['success' => false, 'message' => __('No permission', 'urbackup')]);
-    exit;
-}
-
 $server_id = (int) ($_POST['id'] ?? 0);
 
 if ($server_id <= 0) {
@@ -46,8 +39,13 @@ if ($server_id <= 0) {
 
 $server = new Server();
 
-if (!$server->getFromDB($server_id)) {
-    echo json_encode(['success' => false, 'message' => __('Server not found', 'urbackup')]);
+try {
+    // Entity-aware authorization: checks UPDATE right AND access to the server's entity
+    // (returning the server on success, throwing otherwise).
+    $server->check($server_id, UPDATE);
+} catch (Throwable $e) {
+    http_response_code(403);
+    echo json_encode(['success' => false, 'message' => $e->getMessage()]);
     exit;
 }