QT/InvoiceShelf
1
0
Fork 0
mirror of https://github.com/InvoiceShelf/InvoiceShelf.git synced 2026-07-18 23:05:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): enforce company scope on notes, estimate-convert, and user bulk-delete (#661)

Browse Source 
- Notes IDOR (GHSA-85wc): NotePolicy::viewNotes/manageNotes now receive the
  Note and require hasCompany($note->company_id); NotesController passes the
  bound model to authorize() on show/update/destroy.
- Estimate->Invoice IDOR (GHSA-j2vg): ConvertEstimateController authorizes
  'view' on the source estimate before creating the invoice.
- User bulk-delete (GHSA-wxrv): UsersController scopes candidate ids via
  User::whereCompany() before deletion so cross-company accounts are protected.

Adds feature tests for cross-company 403s plus same-company happy paths.
This commit is contained in:
Darko Gjorgjijoski
2026-06-12 09:17:52 +02:00
committed by GitHub
parent c1cadb7ee0
commit e432e4e62f
7 changed files with 81 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
app/Policies/NotePolicy.php
View File

@@ -11,21 +11,23 @@ class NotePolicy
{
use HandlesAuthorization;
public function manageNotes(User $user)
public function manageNotes(User $user, ?Note $note = null)
{
if (BouncerFacade::can('manage-all-notes', Note::class)) {
return true;
if (! BouncerFacade::can('manage-all-notes', $note ?? Note::class)) {
return false;
}
return false;
// When acting on a specific note, enforce tenant isolation: the note
// must belong to a company the user is a member of.
return $note === null || $user->hasCompany($note->company_id);
}
public function viewNotes(User $user)
public function viewNotes(User $user, ?Note $note = null)
{
if (BouncerFacade::can('view-all-notes', Note::class)) {
return true;
if (! BouncerFacade::can('view-all-notes', $note ?? Note::class)) {
return false;
}
return false;
return $note === null || $user->hasCompany($note->company_id);
}
}