Darko Gjorgjijoski 1ab5228347 Fix CustomerPolicy missing hasCompany() check (cross-company IDOR) ...

Add $user->hasCompany($customer->company_id) check to view, update,
delete, restore, and forceDelete methods in CustomerPolicy, matching
the pattern used by all other policies (InvoicePolicy, PaymentPolicy,
EstimatePolicy, etc.).

Without this check, a user in Company A with view-customer ability
could access customers belonging to Company B by providing the target
customer's ID.

Add cross-company authorization tests to verify the fix.

Closes #565

2026-04-03 13:46:05 +02:00

4.3 KiB

Raw Blame History

View Raw