From 8e163f5ede0ef8e7615651a936dd46c345aa596a Mon Sep 17 00:00:00 2001
From: Ethan Duckett <ethan.duckett@brillpower.com>
Date: Thu, 11 Jun 2026 12:40:44 +0100
Subject: [PATCH] Add write check in handleUpdate

---
 src/ThingSetServer.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ThingSetServer.cpp b/src/ThingSetServer.cpp
index 1da2105..2145400 100644
--- a/src/ThingSetServer.cpp
+++ b/src/ThingSetServer.cpp
@@ -202,7 +202,7 @@ int _ThingSetServer::handleUpdate(ThingSetRequestContext &context)
     context.encoder().encodePreamble();
 
     auto handleNodeUpdate = [&](ThingSetNode *child) {
-        if ((child->getAccess() & _access) == ThingSetAccess::none) {
+        if ((child->getAccess() & _access & ThingSetAccess::anyWrite) == ThingSetAccess::none) {
             context.setStatus(ThingSetStatusCode::forbidden);
             return false;
         }