Files
InvoiceShelf/app/Http/Controllers/V1/Admin/General/NotesController.php
Darko Gjorgjijoski e432e4e62f fix(security): enforce company scope on notes, estimate-convert, and user bulk-delete (#661)
- Notes IDOR (GHSA-85wc): NotePolicy::viewNotes/manageNotes now receive the
  Note and require hasCompany($note->company_id); NotesController passes the
  bound model to authorize() on show/update/destroy.
- Estimate->Invoice IDOR (GHSA-j2vg): ConvertEstimateController authorizes
  'view' on the source estimate before creating the invoice.
- User bulk-delete (GHSA-wxrv): UsersController scopes candidate ids via
  User::whereCompany() before deletion so cross-company accounts are protected.

Adds feature tests for cross-company 403s plus same-company happy paths.
2026-06-12 09:17:52 +02:00

109 lines
2.4 KiB
PHP

<?php
namespace App\Http\Controllers\V1\Admin\General;
use App\Http\Controllers\Controller;
use App\Http\Requests\NotesRequest;
use App\Http\Resources\NoteResource;
use App\Models\Note;
use Illuminate\Http\Request;
use Illuminate\Http\Response;
class NotesController extends Controller
{
/**
* Display a listing of the resource.
*
* @return Response
*/
public function index(Request $request)
{
$this->authorize('view notes');
$limit = $request->limit ?? 10;
$notes = Note::latest()
->whereCompany()
->applyFilters($request->all())
->paginate($limit);
return NoteResource::collection($notes);
}
/**
* Store a newly created resource in storage.
*
* @param Request $request
* @return Response
*/
public function store(NotesRequest $request)
{
$this->authorize('manage notes');
$note = Note::create($request->getNotesPayload());
if ($note->is_default) {
Note::where('id', '!=', $note->id)
->where('type', $note->type)
->where('is_default', true)
->update([
'is_default' => false,
]);
}
return new NoteResource($note);
}
/**
* Display the specified resource.
*
* @return Response
*/
public function show(Note $note)
{
$this->authorize('view notes', $note);
return new NoteResource($note);
}
/**
* Update the specified resource in storage.
*
* @param Request $request
* @return Response
*/
public function update(NotesRequest $request, Note $note)
{
$this->authorize('manage notes', $note);
$note->update($request->getNotesPayload());
if ($note->is_default) {
Note::where('id', '!=', $note->id)
->where('type', $note->type)
->where('is_default', true)
->update([
'is_default' => false,
]);
}
return new NoteResource($note);
}
/**
* Remove the specified resource from storage.
*
* @return Response
*/
public function destroy(Note $note)
{
$this->authorize('manage notes', $note);
$note->delete();
return response()->json([
'success' => true,
]);
}
}