QT/InvoiceShelf
1
0
Fork 0
mirror of https://github.com/InvoiceShelf/InvoiceShelf.git synced 2026-04-09 06:24:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Scope all bulk deletes to current company and fix inverted ownership transfer (#605)

Browse Source 
Bulk delete: filter IDs through whereCompany() before deleting in all
controllers (Invoices, Payments, Items, Expenses, Estimates, Recurring
Invoices). Previously, any user could delete records from other companies
by providing cross-company IDs.

Transfer ownership: fix inverted hasCompany() check that allowed
transferring company ownership to users who do NOT belong to the company,
while blocking users who DO belong.

Ref #567
This commit is contained in:
Darko Gjorgjijoski
2026-04-03 14:16:42 +02:00
committed by GitHub
parent defbfc6406
commit 1adebe85b9
7 changed files with 32 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
app/Http/Controllers/V1/Admin/Company/CompaniesController.php
View File

@@ -61,10 +61,10 @@ class CompaniesController extends Controller
$company = Company::find($request->header('company'));
$this->authorize('transfer company ownership', $company);
if ($user->hasCompany($company->id)) {
if (! $user->hasCompany($company->id)) {
return response()->json([
'success' => false,
'message' => 'User does not belongs to this company.',
'message' => 'User does not belong to this company.',
]);
}