adalal/solidtime
1
0
Fork 0
mirror of https://github.com/solidtime-io/solidtime.git synced 2026-08-08 00:02:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix IDOR private projects

Browse Source
This commit is contained in:
Gregor Vostrak
2026-03-18 21:43:29 +01:00
parent 6218ffceb5
commit 192c8c3b88
2 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/Http/Controllers/Api/V1/ProjectController.php
View File

@@ -78,7 +78,7 @@ class ProjectController extends Controller
*/
public function show(Organization $organization, Project $project): JsonResource
{
$this->checkPermission($organization, 'projects:view', $project);
$this->checkPermission($organization, 'projects:view:all', $project);
// Note: There is currently no need to check if a user is a member of the project,
// since this is only relevant for users with the role "employee" and they can not access this endpoint.

15
tests/Unit/Endpoint/Api/V1/ProjectEndpointTest.php
View File

@@ -281,6 +281,7 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
// Arrange
$data = $this->createUserWithPermission([
'projects:view',
'projects:view:all',
]);
$project = Project::factory()->forOrganization($data->organization)->create();
Passport::actingAs($data->user);
@@ -293,6 +294,20 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
$response->assertJsonPath('data.id', $project->getKey());
}
public function test_show_endpoint_fails_if_employee_tries_to_access_private_project_that_they_are_not_a_member_of(): void
{
// Arrange
$data = $this->createUserWithRole(Role::Employee);
$privateProject = Project::factory()->forOrganization($data->organization)->isPrivate()->create();
Passport::actingAs($data->user);
// Act
$response = $this->getJson(route('api.v1.projects.show', [$data->organization->getKey(), $privateProject->getKey()]));
// Assert
$response->assertForbidden();
}
public function test_store_endpoint_fails_if_user_has_no_permission_to_create_projects(): void
{
// Arrange