Darko Gjorgjijoski defbfc6406 Fix CustomerPolicy missing hasCompany() check (IDOR) (#604) ...

* Fix CustomerPolicy missing hasCompany() check (cross-company IDOR)

Add $user->hasCompany($customer->company_id) check to view, update,
delete, restore, and forceDelete methods in CustomerPolicy, matching
the pattern used by all other policies (InvoicePolicy, PaymentPolicy,
EstimatePolicy, etc.).

Without this check, a user in Company A with view-customer ability
could access customers belonging to Company B by providing the target
customer's ID.

Add cross-company authorization tests to verify the fix.

Closes #565

* Scope bulk delete to current company to prevent cross-company deletion

Filter customer IDs through whereCompany() before passing to
deleteCustomers(), ensuring users cannot delete customers belonging
to other companies via the bulk delete endpoint.

2026-04-03 13:56:34 +02:00

..

Feature

Fix CustomerPolicy missing hasCompany() check (IDOR) (#604)

2026-04-03 13:56:34 +02:00

Unit

Closes #588

2026-04-01 21:30:32 +02:00

Helpers.php

build version 400

2020-12-02 17:54:08 +05:30

Pest.php

Implement PHP CS Fixer and a coding standard to follow (#471)

2021-05-21 17:27:51 +05:30

TestCase.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00