QT/InvoiceShelf
1
0
Fork 0
mirror of https://github.com/InvoiceShelf/InvoiceShelf.git synced 2026-07-17 06:15:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): enforce company scope on notes, doc-convert, and member bulk-delete (#668)

Browse Source 
v3 port of the v2 authorization fixes.

- Notes IDOR (GHSA-85wc): NotePolicy checks the note's company_id and
  NotesController passes the bound model to authorize() on show/update/destroy.
- Estimate<->Invoice convert IDOR (GHSA-j2vg): EstimatesController::convertToInvoice
  and InvoicesController::convertToEstimate authorize 'view' on the source
  document before creating the target.
- Member bulk-delete (GHSA-wxrv): MembersController scopes ids via
  User::whereCompany() before MemberService::delete.

Adds feature tests for cross-company 403s + same-company happy paths.
This commit is contained in:
Darko Gjorgjijoski
2026-06-12 11:02:08 +02:00
committed by GitHub
parent f3ab0f22fc
commit c6a00df120
9 changed files with 94 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/Http/Controllers/Company/General/NotesController.php
View File

@@ -61,7 +61,7 @@ class NotesController extends Controller
*/
public function show(Note $note)
{
$this->authorize('view notes');
$this->authorize('view notes', $note);
return new NoteResource($note);
}
@@ -74,7 +74,7 @@ class NotesController extends Controller
*/
public function update(NotesRequest $request, Note $note)
{
$this->authorize('manage notes');
$this->authorize('manage notes', $note);
$note->update($request->getNotesPayload());
@@ -97,7 +97,7 @@ class NotesController extends Controller
*/
public function destroy(Note $note)
{
$this->authorize('manage notes');
$this->authorize('manage notes', $note);
$note->delete();