InvoiceShelf

mirror of https://github.com/InvoiceShelf/InvoiceShelf.git synced 2026-07-16 22:05:20 +00:00

Files

Darko Gjorgjijoski e56b6b4fe5 fix(security): harden public EmailLog token endpoints (GHSA-73q7) (#669 )

v3 port. Customer PDF controllers resolved the target document by raw
mailable_id ignoring mailable_type, and skipped expiry on the JSON endpoints.

- Resolve via $emailLog->mailable + assert the expected type (404) to close
  cross-type disclosure.
- Enforce isExpired() (403) on every public path incl. the JSON endpoints.
- Harden EmailLog::isExpired() against a null/unresolvable mailable.

Adds tests for cross-type 404, JSON-path expiry 403, and the valid path.

2026-06-12 11:02:11 +02:00

Admin

fix(security): gate AI tools by user ability and block admin-URL SSRF

2026-06-05 00:01:09 +02:00

Company

fix(security): enforce company scope on notes, doc-convert, and member bulk-delete (#668 )

2026-06-12 11:02:08 +02:00

CustomerPortal

fix(security): harden public EmailLog token endpoints (GHSA-73q7) (#669 )

2026-06-12 11:02:11 +02:00

Modules

refactor(modules): migrate asset registry from app/Services to invoiceshelf/modules package