fix #2844

Closes #2844

Merge request studip/studip!2006

lib/classes/JsonApi/Routes/Courseware/Authority.php

@@ -549,5 +549,9 @@ class Authority
         return self::canIndexClipboardsOfAUser($request_user, $user);
     }
 
+    public static function canInsertFromClipboard(User $user, Clipboard $resource)
+    {
+        return $resource->user_id === $user->id;
+    }
 
 }

lib/classes/JsonApi/Routes/Courseware/ClipboardsInsert.php

@@ -35,6 +35,11 @@ class ClipboardsInsert extends NonJsonApiController
         }
 
         $user = $this->getUser($request);
+
+        if (!Authority::canInsertFromClipboard($user, $clipboard)) {
+            throw new AuthorizationFailedException();
+        }
+
         $backup = json_decode($clipboard->backup);
 
         if ($clipboard->object_type === 'courseware-blocks') {