copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #158 from copenhagentruckwash/fix-authorization-bypass-in-self-serve-lanes

Browse Source 
Harden self-serve lane mutation authorization
This commit is contained in:
Jeppe B
2026-05-28 19:25:01 +02:00
committed by GitHub
parent 893ed1bda5 b13abe0d30
commit 76dfcd70d1
1 changed files with 3 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/moduleSelfServeRoute.php
+3 -12
View File
@@ -476,7 +476,7 @@ class moduleSelfServeRoute
$lane,
$customer_number,
'modules_selfserve_lane_command_execute_start',
true
false
);
break;
case selfserve_lane_command::STOP:
@@ -601,11 +601,7 @@ class moduleSelfServeRoute
// Build allowed services from provided tasks
$lane = $selfserve->lane($lane_id);
$customer_number = $this->resolveEffectiveCustomerNumber();
$this->requireSelfServeLaneAccess(
$lane,
$customer_number === null ? 0 : (int)$customer_number,
['modules_selfserve_lane_services_set_allowed']
);
self::requirePermission('modules_selfserve_lane_services_set_allowed');
$allowed_services = [];
foreach ($task_ids as $tid) {
if ($tid <= 0) continue;
@@ -938,12 +934,7 @@ class moduleSelfServeRoute
}
$lane = $selfserve->lane($lane_id);
$customer_number = $this->resolveEffectiveCustomerNumber();
$this->requireSelfServeLaneAccess(
$lane,
$customer_number === null ? 0 : (int)$customer_number,
['modules_selfserve_lane_relay_enable_machine'],
true
);
self::requirePermission('modules_selfserve_lane_relay_enable_machine');
try {
$this->applyShellyTransportOverride($lane);
$lane->turnOnRelay(selfserve_lane_relay::MACHINE, $duration);