QT/InvoiceShelf
1
0
Fork 0
mirror of https://github.com/InvoiceShelf/InvoiceShelf.git synced 2026-07-17 14:25:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): enforce company scope on notes, estimate-convert, and user bulk-delete (#661)

Browse Source 
- Notes IDOR (GHSA-85wc): NotePolicy::viewNotes/manageNotes now receive the
  Note and require hasCompany($note->company_id); NotesController passes the
  bound model to authorize() on show/update/destroy.
- Estimate->Invoice IDOR (GHSA-j2vg): ConvertEstimateController authorizes
  'view' on the source estimate before creating the invoice.
- User bulk-delete (GHSA-wxrv): UsersController scopes candidate ids via
  User::whereCompany() before deletion so cross-company accounts are protected.

Adds feature tests for cross-company 403s plus same-company happy paths.
This commit is contained in:
Darko Gjorgjijoski
2026-06-12 09:17:52 +02:00
committed by GitHub
parent c1cadb7ee0
commit e432e4e62f
7 changed files with 81 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/Http/Controllers/V1/Admin/General/NotesController.php
View File

@@ -61,7 +61,7 @@ class NotesController extends Controller
*/
public function show(Note $note)
{
$this->authorize('view notes');
$this->authorize('view notes', $note);
return new NoteResource($note);
}
@@ -74,7 +74,7 @@ class NotesController extends Controller
*/
public function update(NotesRequest $request, Note $note)
{
$this->authorize('manage notes');
$this->authorize('manage notes', $note);
$note->update($request->getNotesPayload());
@@ -97,7 +97,7 @@ class NotesController extends Controller
*/
public function destroy(Note $note)
{
$this->authorize('manage notes');
$this->authorize('manage notes', $note);
$note->delete();