Severity: CRITICAL
Location: src/Controllers/ForumController.php:1048-1102
Bug: vote() and react() load the post, but never call Forum::canView($thread['forum_id'], $user, $role).
Fix: Resolve thread→forum_id and gate both actions.
Status: open. Will reply with remediation details when resolved.
Resolved.
Added Forum::canView + !Forum::isPreviewOnly guards to both AJAX endpoints in src/Controllers/ForumController.php:
vote() — resolves the post's thread, checks visibility of the parent forum, returns 404 on failure before calling ForumVote::cast.react() — same resolve + visibility gate before calling PostReaction::toggle. Previously react() also didn't findById the post at all.Both endpoints return a 404 JSON shape that matches existing patterns so the client UI degrades gracefully.
Locking this thread.