From 1d51d3baf430da6b4573b42aae5f0db9cea838c1 Mon Sep 17 00:00:00 2001
From: Murtaza Sultani <sultani@data-quest.de>
Date: Thu, 24 Jul 2025 17:14:57 +0200
Subject: Resolve "Wiki verwendet falsche Rechteabfragen in der JSON-API"

Closes #5756

Merge request studip/studip!4390
---
 lib/classes/JsonApi/Routes/Institutes/Authority.php | 2 +-
 lib/classes/JsonApi/Routes/Wiki/Authority.php       | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/classes/JsonApi/Routes/Institutes/Authority.php b/lib/classes/JsonApi/Routes/Institutes/Authority.php
index 2f35c23..2bd68a5 100644
--- a/lib/classes/JsonApi/Routes/Institutes/Authority.php
+++ b/lib/classes/JsonApi/Routes/Institutes/Authority.php
@@ -9,7 +9,7 @@ class Authority
 {
     public static function canShowInstitute(User $user, Institute $institute): bool
     {
-        return $GLOBALS['perm']->have_studip_perm('user', $institute->id, $user->id);
+        return $institute->isAccessibleToUser($user->id);
     }
 
     /**
diff --git a/lib/classes/JsonApi/Routes/Wiki/Authority.php b/lib/classes/JsonApi/Routes/Wiki/Authority.php
index c9ac7bb..e3a8b8b 100644
--- a/lib/classes/JsonApi/Routes/Wiki/Authority.php
+++ b/lib/classes/JsonApi/Routes/Wiki/Authority.php
@@ -7,13 +7,13 @@ class Authority
     /**
      * @SuppressWarnings(PHPMD.Superglobals)
      */
-    public static function canIndexWiki(\User $user, $range)
+    public static function canIndexWiki(\User $user, \Range $range)
     {
         if (!($range instanceof \Course || $range instanceof \Institute)) {
             return false;
         }
 
-        return $GLOBALS['perm']->have_studip_perm('user', $range->id, $user->id);
+        return $range->isAccessibleToUser($user->id);
     }
 
     /**
-- 
cgit v1.0