diff --git a/application/Espo/Services/Note.php b/application/Espo/Services/Note.php index 84213a324e..f8071fd44c 100644 --- a/application/Espo/Services/Note.php +++ b/application/Espo/Services/Note.php @@ -169,6 +169,7 @@ class Note extends Record /** * @param NoteEntity $entity * @param stdClass $data + * @throws Forbidden */ protected function beforeUpdateEntity(Entity $entity, $data) { @@ -178,6 +179,10 @@ class Note extends Record $this->handlePostText($entity); } + if (!$entity->isPost() && !$this->user->isAdmin()) { + throw new ForbiddenSilent("Only 'Post' type allowed."); + } + $entity->clear('targetType'); $entity->clear('usersIds'); $entity->clear('teamsIds');