PMCORE-4204

workflow/engine/methods/scheduler/index.php

@@ -1,6 +1,15 @@
 <?php
 
 use ProcessMaker\Core\System;
+use ProcessMaker\Exception\RBACException;
+
+// Include global object RBAC
+global $RBAC;
+
+// Check if the current user have the correct permissions to access to this resource, if not throws a RBAC Exception with code 403
+if ($RBAC->userCanAccess('PM_TASK_SCHEDULER_ADMIN') !== 1) {
+    throw new RBACException('ID_ACCESS_DENIED', 403);
+}
 
 try {
     global $G_PUBLISH;