QT/InvoiceShelf
1
0
Fork 0
mirror of https://github.com/InvoiceShelf/InvoiceShelf.git synced 2026-07-18 23:05:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden public EmailLog token endpoints (GHSA-73q7) (#669)

Browse Source 
v3 port. Customer PDF controllers resolved the target document by raw
mailable_id ignoring mailable_type, and skipped expiry on the JSON endpoints.

- Resolve via $emailLog->mailable + assert the expected type (404) to close
  cross-type disclosure.
- Enforce isExpired() (403) on every public path incl. the JSON endpoints.
- Harden EmailLog::isExpired() against a null/unresolvable mailable.

Adds tests for cross-type 404, JSON-path expiry 403, and the valid path.
This commit is contained in:
Darko Gjorgjijoski
2026-06-12 11:02:11 +02:00
committed by GitHub
parent c6a00df120
commit e56b6b4fe5
5 changed files with 131 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
app/Http/Controllers/CustomerPortal/EstimatePdfController.php
View File

@@ -15,38 +15,38 @@ class EstimatePdfController extends Controller
{
public function getPdf(EmailLog $emailLog, Request $request)
{
$estimate = Estimate::find($emailLog->mailable_id);
$estimate = $emailLog->mailable;
abort_unless($estimate instanceof Estimate, 404);
abort_if($emailLog->isExpired(), 403, 'Link Expired.');
if (! $emailLog->isExpired()) {
if ($estimate && ($estimate->status == Estimate::STATUS_SENT || $estimate->status == Estimate::STATUS_DRAFT)) {
$estimate->status = Estimate::STATUS_VIEWED;
$estimate->save();
$notifyEstimateViewed = CompanySetting::getSetting(
'notify_estimate_viewed',
if ($estimate->status == Estimate::STATUS_SENT || $estimate->status == Estimate::STATUS_DRAFT) {
$estimate->status = Estimate::STATUS_VIEWED;
$estimate->save();
$notifyEstimateViewed = CompanySetting::getSetting(
'notify_estimate_viewed',
$estimate->company_id
);
if ($notifyEstimateViewed == 'YES') {
$data['estimate'] = Estimate::findOrFail($estimate->id)->toArray();
$data['user'] = Customer::find($estimate->customer_id)->toArray();
$notificationEmail = CompanySetting::getSetting(
'notification_email',
$estimate->company_id
);
if ($notifyEstimateViewed == 'YES') {
$data['estimate'] = Estimate::findOrFail($estimate->id)->toArray();
$data['user'] = Customer::find($estimate->customer_id)->toArray();
$notificationEmail = CompanySetting::getSetting(
'notification_email',
$estimate->company_id
);
\Mail::to($notificationEmail)->send(new EstimateViewedMail($data));
}
\Mail::to($notificationEmail)->send(new EstimateViewedMail($data));
}
return $estimate->getGeneratedPDFOrStream('estimate');
}
abort(403, 'Link Expired.');
return $estimate->getGeneratedPDFOrStream('estimate');
}
public function getEstimate(EmailLog $emailLog)
{
$estimate = Estimate::find($emailLog->mailable_id);
$estimate = $emailLog->mailable;
abort_unless($estimate instanceof Estimate, 404);
abort_if($emailLog->isExpired(), 403, 'Link Expired.');
return new EstimateResource($estimate);
}

61
app/Http/Controllers/CustomerPortal/InvoicePdfController.php
View File

@@ -15,46 +15,49 @@ class InvoicePdfController extends Controller
{
public function getPdf(EmailLog $emailLog, Request $request)
{
$invoice = Invoice::find($emailLog->mailable_id);
// Resolve the document through the morph relation and enforce the
// expected type — a token issued for another mailable type (or whose
// numeric id collides) must not disclose an invoice.
$invoice = $emailLog->mailable;
abort_unless($invoice instanceof Invoice, 404);
abort_if($emailLog->isExpired(), 403, 'Link Expired.');
if (! $emailLog->isExpired()) {
if ($invoice && ($invoice->status == Invoice::STATUS_SENT || $invoice->status == Invoice::STATUS_DRAFT)) {
$invoice->status = Invoice::STATUS_VIEWED;
$invoice->viewed = true;
$invoice->save();
$notifyInvoiceViewed = CompanySetting::getSetting(
'notify_invoice_viewed',
if ($invoice->status == Invoice::STATUS_SENT || $invoice->status == Invoice::STATUS_DRAFT) {
$invoice->status = Invoice::STATUS_VIEWED;
$invoice->viewed = true;
$invoice->save();
$notifyInvoiceViewed = CompanySetting::getSetting(
'notify_invoice_viewed',
$invoice->company_id
);
if ($notifyInvoiceViewed == 'YES') {
$data['invoice'] = Invoice::findOrFail($invoice->id)->toArray();
$data['user'] = Customer::find($invoice->customer_id)->toArray();
$notificationEmail = CompanySetting::getSetting(
'notification_email',
$invoice->company_id
);
if ($notifyInvoiceViewed == 'YES') {
$data['invoice'] = Invoice::findOrFail($invoice->id)->toArray();
$data['user'] = Customer::find($invoice->customer_id)->toArray();
$notificationEmail = CompanySetting::getSetting(
'notification_email',
$invoice->company_id
);
\Mail::to($notificationEmail)->send(new InvoiceViewedMail($data));
}
\Mail::to($notificationEmail)->send(new InvoiceViewedMail($data));
}
if ($request->has('pdf')) {
return $invoice->getGeneratedPDFOrStream('invoice');
}
return view('app')->with([
'customer_logo' => get_company_setting('customer_portal_logo', $invoice->company_id),
'current_theme' => get_company_setting('customer_portal_theme', $invoice->company_id),
]);
}
abort(403, 'Link Expired.');
if ($request->has('pdf')) {
return $invoice->getGeneratedPDFOrStream('invoice');
}
return view('app')->with([
'customer_logo' => get_company_setting('customer_portal_logo', $invoice->company_id),
'current_theme' => get_company_setting('customer_portal_theme', $invoice->company_id),
]);
}
public function getInvoice(EmailLog $emailLog)
{
$invoice = Invoice::find($emailLog->mailable_id);
$invoice = $emailLog->mailable;
abort_unless($invoice instanceof Invoice, 404);
abort_if($emailLog->isExpired(), 403, 'Link Expired.');
return new CustomerInvoiceResource($invoice);
}

12
app/Http/Controllers/CustomerPortal/PaymentPdfController.php
View File

@@ -12,16 +12,18 @@ class PaymentPdfController extends Controller
{
public function getPdf(EmailLog $emailLog, Request $request)
{
if (! $emailLog->isExpired()) {
return $emailLog->mailable->getGeneratedPDFOrStream('payment');
}
$payment = $emailLog->mailable;
abort_unless($payment instanceof Payment, 404);
abort_if($emailLog->isExpired(), 403, 'Link Expired.');
abort(403, 'Link Expired.');
return $payment->getGeneratedPDFOrStream('payment');
}
public function getPayment(EmailLog $emailLog)
{
$payment = Payment::find($emailLog->mailable_id);
$payment = $emailLog->mailable;
abort_unless($payment instanceof Payment, 404);
abort_if($emailLog->isExpired(), 403, 'Link Expired.');
return new PaymentResource($payment);
}