{"record":{"id":"61fc79e763a183af","repo":"passbolt/passbolt_api","slug":"you-are-not-allowed-to-access-this-location-61fc79","errorCode":null,"errorMessage":"You are not allowed to access this location.","messagePattern":"You are not allowed to access this location\\.","errorType":"http","errorClass":"Cake\\Http\\Exception\\ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltCe/EmailNotificationSettings/src/Controller/NotificationOrgSettings/NotificationOrgSettingsPostController.php","lineNumber":68,"sourceCode":"        $updatedNotificationSettings = EmailNotificationSettings::get();\n\n        $flatten = Hash::flatten($updatedNotificationSettings);\n\n        $msg = __('The notification settings for the organization were updated.');\n        $this->success($msg, $this->_formatForOutput($flatten));\n    }\n\n    /**\n     * Validate the request body\n     *\n     * @return array if the request body is valid\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException If the user making request is not admin\n     * @throws \\Cake\\Http\\Exception\\BadRequestException If the request is not a Ajax/Json type\n     */\n    private function _validateRequestData(): array\n    {\n        if ($this->User->role() !== Role::ADMIN) {\n            throw new ForbiddenException(__('You are not allowed to access this location.'));\n        }\n        if (!$this->request->is('json')) {\n            throw new BadRequestException(__('This is not a valid Ajax/Json request.'));\n        }\n\n        $data = $this->request->getData();\n\n        foreach ($data as $key => $value) {\n            $data[$key] = QueryStringComponent::normalizeBoolean($value);\n        }\n\n        $form = new EmailNotificationSettingsForm();\n\n        if (!$form->validate($data)) {\n            $errors = $form->getErrors();\n\n            throw new CustomValidationException(__('The supplied email notification settings are not valid'), $errors);\n        }","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/EmailNotificationSettings/src/Controller/NotificationOrgSettings/NotificationOrgSettingsPostController.php#L50-L86","documentation":"A ForbiddenException thrown by NotificationOrgSettingsPostController::_validateRequestData when the authenticated user's role is not Role::ADMIN. The email notification organization settings can only be modified by administrators, so any non-admin POST to /email-notification-settings/org-settings is rejected with this message.","triggerScenarios":"POST to the email notification settings org settings endpoint (NotificationOrgSettingsPostController::post) while the request is authenticated as a user whose role() !== Role::ADMIN (e.g. 'user' or 'guest' role).","commonSituations":"Developers testing the endpoint with a regular user account or an API token bound to a non-admin user; users whose role was downgraded; requests where role resolution falls back to a non-admin (expired/limited account) even though the developer expected admin rights.","solutions":["Authenticate the request with an administrator account (role == 'admin') before calling the endpoint.","Check the user's role via the Users table or User role() and confirm it is Role::ADMIN.","If the user should be an admin, update their role in the users table and re-issue/re-login their session.","Verify the client is sending the correct CSRF/session/auth token so the right user is identified."],"exampleFix":"// before (regular user token)\ncurl -X POST -H 'X-Http-Token: <user-token>' /email-notification-settings/org-settings\n\n// after (admin token)\ncurl -X POST -H 'X-Http-Token: <admin-token>' /email-notification-settings/org-settings","handlingStrategy":"validation","validationCode":"$user = User::find()->where(['id' => $userId])->first();\nif (!$user || $user->role->name !== Role::ADMIN) {\n    throw new ForbiddenException(__('You are not allowed to access this location.'));\n}","typeGuard":"function isAdmin(?User $user): bool { return $user !== null && $user->get('role')->get('name') === Role::ADMIN; }","tryCatchPattern":"try {\n    $response = $client->postEmailNotificationOrgSettings($data);\n} catch (ForbiddenException $e) {\n    // non-admin user; surface permission error to the caller\n}","preventionTips":["Only invoke this endpoint from flows guaranteed to run as an admin.","Check the user's role client-side before making the request and hide/disable the action otherwise.","Never cache admin-only actions behind shared or service-account tokens with non-admin roles.","Log the acting user id on authorization failures to ease debugging."],"tags":["authorization","forbidden","roles","controller"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}