[HIGH] H5: isUserInGroup permanently broken — undefined variable makes all admin checks return false

[rubenvdlinde]

Severity: HIGH

Location: lib/Controller/AangebodenGebruikController.php lines 466–511, specifically line 483

Description:
isUserInGroup references a bare $groupManager variable that has never been declared in scope. PHP raises an "Undefined variable" E_WARNING which is caught and causes the method to unconditionally return false. As a result:

• Every isAmbtenaar() and isAdmin() check returns false.
• Admins receive 403 responses from routes that gate on these helpers.
• Organisation filters that rely on these helpers are silently dropped, returning unfiltered data to non-admin users.

Suggested fix:
Replace $groupManager on line 483 with $this->groupManager.

---

Source: deep team-reviewer pass 2026-05-27

[rubenvdlinde]

Fixed in #354 (merged to development).