QT/InvoiceShelf
1
0
Fork 0
mirror of https://github.com/InvoiceShelf/InvoiceShelf.git synced 2026-07-17 14:25:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): enforce company scope on notes, estimate-convert, and user bulk-delete (#661)

Browse Source 
- Notes IDOR (GHSA-85wc): NotePolicy::viewNotes/manageNotes now receive the
  Note and require hasCompany($note->company_id); NotesController passes the
  bound model to authorize() on show/update/destroy.
- Estimate->Invoice IDOR (GHSA-j2vg): ConvertEstimateController authorizes
  'view' on the source estimate before creating the invoice.
- User bulk-delete (GHSA-wxrv): UsersController scopes candidate ids via
  User::whereCompany() before deletion so cross-company accounts are protected.

Adds feature tests for cross-company 403s plus same-company happy paths.
This commit is contained in:
Darko Gjorgjijoski
2026-06-12 09:17:52 +02:00
committed by GitHub
parent c1cadb7ee0
commit e432e4e62f
7 changed files with 81 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
tests/Feature/Admin/UserTest.php
View File

@@ -2,6 +2,7 @@
use App\Http\Controllers\V1\Admin\Users\UsersController;
use App\Http\Requests\UserRequest;
use App\Models\Company;
use App\Models\User;
use Laravel\Sanctum\Sanctum;
@@ -86,12 +87,21 @@ test('update user using a form request', function () {
// ]);
// });
// test('delete users', function () {
// $user = User::factory()->create();
// $data['users'] = [$user->id];
test('deletes a user belonging to the current company', function () {
$companyId = User::where('role', 'super admin')->first()->companies()->first()->id;
$user = User::factory()->create();
$user->companies()->attach($companyId);
// postJson("/api/v1/users/delete", $data)
// ->assertOk();
postJson('/api/v1/users/delete', ['users' => [$user->id]])->assertOk();
// $this->assertModelMissing($user);
// });
$this->assertDatabaseMissing('users', ['id' => $user->id]);
});
test('cannot bulk delete a user belonging to another company', function () {
$user = User::factory()->create();
$user->companies()->attach(Company::factory()->create()->id);
postJson('/api/v1/users/delete', ['users' => [$user->id]])->assertOk();
$this->assertDatabaseHas('users', ['id' => $user->id]);
});