From a5cde645504bc894a180e25597024a52daa38ae8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hmer?= <mail@jan-boehmer.de>
Date: Sun, 2 Aug 2026 15:03:21 +0200
Subject: [PATCH] Check that user has permissions to actually read the elements
 they wanna generate labels for

---
 src/Controller/LabelController.php | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/Controller/LabelController.php b/src/Controller/LabelController.php
index 90a6715b..f5008c68 100644
--- a/src/Controller/LabelController.php
+++ b/src/Controller/LabelController.php
@@ -176,6 +176,12 @@ class LabelController extends AbstractController
 
             $target_id = (string) $form->get('target_id')->getData();
             $targets = $this->findObjects($form_options->getSupportedElement(), $target_id);
+
+            //Check that we have read access to the targets
+            foreach ($targets as $target) {
+                $this->denyAccessUnlessGranted('read', $target);
+            }
+
             if ($targets !== []) {
                 try {
                     $pdf_data = $this->labelGenerator->generateLabel($form_options, $targets);