copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #192 from copenhagentruckwash/fix-subuser-permission-evaluation-vulnerability

Browse Source 
Use resolved customer context in subuser permission checks
This commit is contained in:
Jeppe B
2026-06-01 22:34:56 +02:00
committed by GitHub
parent 5684da1bc7 22dd9f9c07
commit 1616bd431a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/traits/route_t.php
+1 -1
View File
@@ -422,7 +422,7 @@ trait route_t
if ($cached !== null) { if ($cached !== null) {
self::$__perm_subuser_grant_cache[$cacheKey] = $cached; self::$__perm_subuser_grant_cache[$cacheKey] = $cached;
} else { } else {
$subuser_has_permission = $subuser->hasPermission($permission->subusers_node_key); $subuser_has_permission = $subuser->hasPermission($permission->subusers_node_key, (int)$resolvedCustomer);
if (defined('redis')) { if (defined('redis')) {
redis->cache_permission($cacheKey, $subuser_has_permission); redis->cache_permission($cacheKey, $subuser_has_permission);
} }