From 35c4837f63799934d848d5e3530592f199a3a27a Mon Sep 17 00:00:00 2001
From: sparkyx <danydb@noalyss.eu>
Date: Sat, 19 Jul 2025 12:09:08 +0200
Subject: [PATCH] Security C0CARD

---
 include/ajax/ajax_card_attribute.php | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/include/ajax/ajax_card_attribute.php b/include/ajax/ajax_card_attribute.php
index 09ad2c1b5..d48feb9a3 100644
--- a/include/ajax/ajax_card_attribute.php
+++ b/include/ajax/ajax_card_attribute.php
@@ -23,9 +23,16 @@
  * @file
  * @brief answer to card_attr_inc.php
  */
+/*
+ * @var $g_user Noalyss_User
+ */
 global $g_user;
 // security
-$g_user->can_request("CCARDAT");
+if ( $g_user->check_module("C0CARD") == 0 ) {
+    
+    record_log(new \Exception("C0CARD1: not authorized"));
+    return;
+}
 
 $http=new HttpInput();