Files
InvoiceShelf/app/Http/Controllers/V1/Admin/Users/UsersController.php
Darko Gjorgjijoski e432e4e62f fix(security): enforce company scope on notes, estimate-convert, and user bulk-delete (#661)
- Notes IDOR (GHSA-85wc): NotePolicy::viewNotes/manageNotes now receive the
  Note and require hasCompany($note->company_id); NotesController passes the
  bound model to authorize() on show/update/destroy.
- Estimate->Invoice IDOR (GHSA-j2vg): ConvertEstimateController authorizes
  'view' on the source estimate before creating the invoice.
- User bulk-delete (GHSA-wxrv): UsersController scopes candidate ids via
  User::whereCompany() before deletion so cross-company accounts are protected.

Adds feature tests for cross-company 403s plus same-company happy paths.
2026-06-12 09:17:52 +02:00

110 lines
2.6 KiB
PHP

<?php
namespace App\Http\Controllers\V1\Admin\Users;
use App\Http\Controllers\Controller;
use App\Http\Requests\DeleteUserRequest;
use App\Http\Requests\UserRequest;
use App\Http\Resources\UserResource;
use App\Models\User;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
class UsersController extends Controller
{
/**
* Display a listing of the resource.
*
* @return JsonResponse
*/
public function index(Request $request)
{
$this->authorize('viewAny', User::class);
$limit = $request->has('limit') ? $request->limit : 10;
$user = $request->user();
$users = User::whereCompany()
->applyFilters($request->all())
->where('id', '<>', $user->id)
->latest()
->paginate($limit);
return UserResource::collection($users)
->additional(['meta' => [
'user_total_count' => User::whereCompany()->count(),
]]);
}
/**
* Store a newly created resource in storage.
*
* @param \Illuminate\Http\UserRequest $request
* @return JsonResponse
*/
public function store(UserRequest $request)
{
$this->authorize('create', User::class);
$user = User::createFromRequest($request);
return new UserResource($user);
}
/**
* Display the specified resource.
*
* @return JsonResponse
*/
public function show(User $user)
{
$this->authorize('view', $user);
return new UserResource($user);
}
/**
* Update the specified resource in storage.
*
* @param \Illuminate\Http\UserRequest $request
* @return JsonResponse
*/
public function update(UserRequest $request, User $user)
{
$this->authorize('update', $user);
$user->updateFromRequest($request);
return new UserResource($user);
}
/**
* Display a listing of the resource.
*
* @param Request $request
* @return JsonResponse
*/
public function delete(DeleteUserRequest $request)
{
$this->authorize('delete multiple users', User::class);
if ($request->users) {
// Scope the candidate ids to members of the acting company so a user
// from one company cannot delete accounts belonging to another.
$ids = User::whereCompany()
->whereIn('id', $request->users)
->pluck('id')
->toArray();
if ($ids) {
User::deleteUsers($ids);
}
}
return response()->json([
'success' => true,
]);
}
}