adalal/solidtime
1
0
Fork 0
mirror of https://github.com/solidtime-io/solidtime.git synced 2026-08-08 00:02:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix IDOR private projects

Browse Source
This commit is contained in:
Gregor Vostrak
2026-03-18 21:43:29 +01:00
parent 6218ffceb5
commit 192c8c3b88
2 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
tests/Unit/Endpoint/Api/V1/ProjectEndpointTest.php
View File

@@ -281,6 +281,7 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
// Arrange
$data = $this->createUserWithPermission([
'projects:view',
'projects:view:all',
]);
$project = Project::factory()->forOrganization($data->organization)->create();
Passport::actingAs($data->user);
@@ -293,6 +294,20 @@ class ProjectEndpointTest extends ApiEndpointTestAbstract
$response->assertJsonPath('data.id', $project->getKey());
}
public function test_show_endpoint_fails_if_employee_tries_to_access_private_project_that_they_are_not_a_member_of(): void
{
// Arrange
$data = $this->createUserWithRole(Role::Employee);
$privateProject = Project::factory()->forOrganization($data->organization)->isPrivate()->create();
Passport::actingAs($data->user);
// Act
$response = $this->getJson(route('api.v1.projects.show', [$data->organization->getKey(), $privateProject->getKey()]));
// Assert
$response->assertForbidden();
}
public function test_store_endpoint_fails_if_user_has_no_permission_to_create_projects(): void
{
// Arrange