InvoiceShelf

mirror of https://github.com/InvoiceShelf/InvoiceShelf.git synced 2026-07-17 14:25:21 +00:00

Files

Darko Gjorgjijoski e432e4e62f fix(security): enforce company scope on notes, estimate-convert, and user bulk-delete (#661 )

- Notes IDOR (GHSA-85wc): NotePolicy::viewNotes/manageNotes now receive the
  Note and require hasCompany($note->company_id); NotesController passes the
  bound model to authorize() on show/update/destroy.
- Estimate->Invoice IDOR (GHSA-j2vg): ConvertEstimateController authorizes
  'view' on the source estimate before creating the invoice.
- User bulk-delete (GHSA-wxrv): UsersController scopes candidate ids via
  User::whereCompany() before deletion so cross-company accounts are protected.

Adds feature tests for cross-company 403s plus same-company happy paths.

2026-06-12 09:17:52 +02:00

ChangeEstimateStatusController.php

Pint

2026-03-21 18:59:53 +01:00

CloneEstimateController.php

Add company ownership check to clone endpoints (#606 )

2026-04-03 14:32:12 +02:00

ConvertEstimateController.php

fix(security): enforce company scope on notes, estimate-convert, and user bulk-delete (#661 )

2026-06-12 09:17:52 +02:00

EstimatesController.php

Scope all bulk deletes to current company and fix inverted ownership transfer (#605 )