Darko Gjorgjijoski c6a00df120 fix(security): enforce company scope on notes, doc-convert, and member bulk-delete (#668) ...

v3 port of the v2 authorization fixes.

- Notes IDOR (GHSA-85wc): NotePolicy checks the note's company_id and
  NotesController passes the bound model to authorize() on show/update/destroy.
- Estimate<->Invoice convert IDOR (GHSA-j2vg): EstimatesController::convertToInvoice
  and InvoicesController::convertToEstimate authorize 'view' on the source
  document before creating the target.
- Member bulk-delete (GHSA-wxrv): MembersController scopes ids via
  User::whereCompany() before MemberService::delete.

Adds feature tests for cross-company 403s + same-company happy paths.

2026-06-12 11:02:08 +02:00

..

Feature

fix(security): enforce company scope on notes, doc-convert, and member bulk-delete (#668)

2026-06-12 11:02:08 +02:00

Support

fix(security): gate AI tools by user ability and block admin-URL SSRF

2026-06-05 00:01:09 +02:00

Unit

fix(security): gate AI tools by user ability and block admin-URL SSRF

2026-06-05 00:01:09 +02:00

Helpers.php

build version 400

2020-12-02 17:54:08 +05:30

Pest.php

Implement PHP CS Fixer and a coding standard to follow (#471)

2021-05-21 17:27:51 +05:30

TestCase.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00