Darko Gjorgjijoski e432e4e62f fix(security): enforce company scope on notes, estimate-convert, and user bulk-delete (#661) ...

- Notes IDOR (GHSA-85wc): NotePolicy::viewNotes/manageNotes now receive the
  Note and require hasCompany($note->company_id); NotesController passes the
  bound model to authorize() on show/update/destroy.
- Estimate->Invoice IDOR (GHSA-j2vg): ConvertEstimateController authorizes
  'view' on the source estimate before creating the invoice.
- User bulk-delete (GHSA-wxrv): UsersController scopes candidate ids via
  User::whereCompany() before deletion so cross-company accounts are protected.

Adds feature tests for cross-company 403s plus same-company happy paths.

2026-06-12 09:17:52 +02:00

..

BackupTest.php

Updates the "create backup" test to handle the disk prefix.

2026-03-24 23:00:47 -04:00

CompanySettingTest.php

feat: Tax included (#370)

2025-08-28 10:28:24 +02:00

CompanyTest.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00

ConfigTest.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00

CurrenciesTest.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00

CustomerTest.php

Fix CustomerPolicy missing hasCompany() check (IDOR) (#604)

2026-04-03 13:56:34 +02:00

CustomFieldTest.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00

DashboardTest.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00

EstimateTest.php

fix(security): enforce company scope on notes, estimate-convert, and user bulk-delete (#661)

2026-06-12 09:17:52 +02:00

ExpenseCategoryTest.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00

ExpenseTest.php

Duplicate expense

2026-04-07 19:00:07 +02:00

FileDiskTest.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00

InvoiceTest.php

feat: Tax included (#370)

2025-08-28 10:28:24 +02:00

ItemTest.php

Adding Flat Tax support with fixed amount (#253)

2025-05-04 02:24:56 +02:00

LocationTest.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00

NextNumberTest.php

Reformat with pint

2025-01-12 18:37:08 +01:00

NotesTest.php

fix(security): enforce company scope on notes, estimate-convert, and user bulk-delete (#661)

2026-06-12 09:17:52 +02:00

PaymentMethodTest.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00

PaymentTest.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00

RecurringInvoiceTest.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00

RoleTest.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00

TaxTypeTest.php

Increasing tax decimal

2026-04-07 18:35:30 +02:00

UnitTest.php

Laravel 11 (#84)

2024-06-05 11:33:52 +02:00

UserTest.php

fix(security): enforce company scope on notes, estimate-convert, and user bulk-delete (#661)

2026-06-12 09:17:52 +02:00