mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-04-12 15:57:22 +00:00
3a1bfd3824
Verify the source record belongs to the current company before cloning. Previously, users could clone invoices/estimates from other companies, leaking sensitive data (amounts, customer details, items, taxes, notes). The view policy already includes hasCompany() check, so authorizing view on the source record gates both ability and company ownership. Ref #574