mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-07-17 22:35:19 +00:00
v3 port of the v2 authorization fixes. - Notes IDOR (GHSA-85wc): NotePolicy checks the note's company_id and NotesController passes the bound model to authorize() on show/update/destroy. - Estimate<->Invoice convert IDOR (GHSA-j2vg): EstimatesController::convertToInvoice and InvoicesController::convertToEstimate authorize 'view' on the source document before creating the target. - Member bulk-delete (GHSA-wxrv): MembersController scopes ids via User::whereCompany() before MemberService::delete. Adds feature tests for cross-company 403s + same-company happy paths.
109 lines
2.4 KiB
PHP
109 lines
2.4 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers\Company\General;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Http\Requests\NotesRequest;
|
|
use App\Http\Resources\NoteResource;
|
|
use App\Models\Note;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Http\Response;
|
|
|
|
class NotesController extends Controller
|
|
{
|
|
/**
|
|
* Display a listing of the resource.
|
|
*
|
|
* @return Response
|
|
*/
|
|
public function index(Request $request)
|
|
{
|
|
$this->authorize('view notes');
|
|
|
|
$limit = $request->limit ?? 10;
|
|
|
|
$notes = Note::latest()
|
|
->whereCompany()
|
|
->applyFilters($request->all())
|
|
->paginate($limit);
|
|
|
|
return NoteResource::collection($notes);
|
|
}
|
|
|
|
/**
|
|
* Store a newly created resource in storage.
|
|
*
|
|
* @param Request $request
|
|
* @return Response
|
|
*/
|
|
public function store(NotesRequest $request)
|
|
{
|
|
$this->authorize('manage notes');
|
|
|
|
$note = Note::create($request->getNotesPayload());
|
|
|
|
if ($note->is_default) {
|
|
Note::where('id', '!=', $note->id)
|
|
->where('type', $note->type)
|
|
->where('is_default', true)
|
|
->update([
|
|
'is_default' => false,
|
|
]);
|
|
}
|
|
|
|
return new NoteResource($note);
|
|
}
|
|
|
|
/**
|
|
* Display the specified resource.
|
|
*
|
|
* @return Response
|
|
*/
|
|
public function show(Note $note)
|
|
{
|
|
$this->authorize('view notes', $note);
|
|
|
|
return new NoteResource($note);
|
|
}
|
|
|
|
/**
|
|
* Update the specified resource in storage.
|
|
*
|
|
* @param Request $request
|
|
* @return Response
|
|
*/
|
|
public function update(NotesRequest $request, Note $note)
|
|
{
|
|
$this->authorize('manage notes', $note);
|
|
|
|
$note->update($request->getNotesPayload());
|
|
|
|
if ($note->is_default) {
|
|
Note::where('id', '!=', $note->id)
|
|
->where('type', $note->type)
|
|
->where('is_default', true)
|
|
->update([
|
|
'is_default' => false,
|
|
]);
|
|
}
|
|
|
|
return new NoteResource($note);
|
|
}
|
|
|
|
/**
|
|
* Remove the specified resource from storage.
|
|
*
|
|
* @return Response
|
|
*/
|
|
public function destroy(Note $note)
|
|
{
|
|
$this->authorize('manage notes', $note);
|
|
|
|
$note->delete();
|
|
|
|
return response()->json([
|
|
'success' => true,
|
|
]);
|
|
}
|
|
}
|