Darko Gjorgjijoski 1adebe85b9 Scope all bulk deletes to current company and fix inverted ownership transfer (#605) ...

Bulk delete: filter IDs through whereCompany() before deleting in all
controllers (Invoices, Payments, Items, Expenses, Estimates, Recurring
Invoices). Previously, any user could delete records from other companies
by providing cross-company IDs.

Transfer ownership: fix inverted hasCompany() check that allowed
transferring company ownership to users who do NOT belong to the company,
while blocking users who DO belong.

Ref #567

2026-04-03 14:16:42 +02:00

..

CompaniesController.php

Scope all bulk deletes to current company and fix inverted ownership transfer (#605)

2026-04-03 14:16:42 +02:00

CompanyController.php

Pint

2026-03-21 18:59:53 +01:00