copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Enforce department access on Stripe payment intent order routes

Browse Source
This commit is contained in:
Jeppe B
2026-06-01 22:36:49 +02:00
parent 4945abfd8e
commit 4703e07951
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/ordersRoute.php
+7 -1
View File
@@ -544,6 +544,8 @@ class ordersRoute
if (!$order->exists()) {
$response->error('Order not found', 400);
}
// Check if the user has access to the department
self::requireDepartmentAccess((int)$order->department_id->value());
// Get the department
$department = (new departments_o())->selectId((int)$order->department_id->value());
// Check if the department is configured for Stripe payments
@@ -653,6 +655,8 @@ class ordersRoute
if (!$order->exists()) {
$response->error('Order not found', 400);
}
// Check if the user has access to the department
self::requireDepartmentAccess((int)$order->department_id->value());
// Check if the order has a payment intent
$stripe_payment_intents = new stripe_payment_intents_o();
if (!$stripe_payment_intents->doesOrderHavePaymentIntent((int)$order->id)) {
@@ -705,6 +709,8 @@ class ordersRoute
if (!$order->exists()) {
$response->error('Order not found', 400);
}
// Check if the user has access to the department
self::requireDepartmentAccess((int)$order->department_id->value());
// Check if the order has a payment intent
$stripe_payment_intents = new stripe_payment_intents_o();
if (!$stripe_payment_intents->doesOrderHavePaymentIntent((int)$order->id)) {
@@ -1038,4 +1044,4 @@ class ordersRoute
// Optional fields are not checked here, as they are optional and can be empty
return $data;
}
}
}