copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Fix IDOR in order item update route

Browse Source
This commit is contained in:
Jeppe B
2026-06-01 22:55:35 +02:00
parent 7835f068b6
commit 652b89d23d
1 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/orderItemsRoute.php
+17 -1
View File
@@ -203,6 +203,22 @@ class orderItemsRoute
if (!isset($data['quantity'])) {
$response->error('Quantity is required', 400);
}
$orderItem = (new order_items_o())->select((int)$data['id']);
if (!$orderItem->exists()) {
$response->error('Order item not found', 404);
}
$order = (new orders_o())->getOrderById((int)$orderItem->order_id->value());
if (!$order->exists()) {
$response->error('Order not found', 404);
}
$canAccessAllOrderItems = $this->hasPermission('list_order_items');
if (!$canAccessAllOrderItems && !$order->isOwnOrder((int)$user->customer_number->value())) {
$response->error('Order item does not belong to the user', 403);
}
// Update the order item
(new order_items_o())->updateOrderItem((int)$data['id'], (int)$data['price'], (string)$data['notes'], (string)$data['reference'], (int)$data['quantity']);
// Log the incident
@@ -223,4 +239,4 @@ class orderItemsRoute
]
);
}
}
}