copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Fix property gate command authorization bypass

Browse Source
This commit is contained in:
Jeppe B
2026-06-01 20:57:21 +02:00
parent 690e114d38
commit 787db994dd
3 changed files with 3 additions and 186 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/moduleSelfServeRoute.php
+2 -88
View File
@@ -429,18 +429,10 @@ class moduleSelfServeRoute
self::requirePermission('modules_selfserve_lane_command_execute_reset');
break;
case selfserve_lane_command::OPEN_PROPERTY_ACCESS_GATE:
$this->requirePropertyGateCommandPermission(
'modules_selfserve_lane_command_execute_open_property_access_gate',
$lane,
(int)$user->customer_number->value()
);
self::requirePermission('modules_selfserve_lane_command_execute_open_property_access_gate');
break;
case selfserve_lane_command::OPEN_PROPERTY_EXIT_GATE:
$this->requirePropertyGateCommandPermission(
'modules_selfserve_lane_command_execute_open_property_exit_gate',
$lane,
(int)$user->customer_number->value()
);
self::requirePermission('modules_selfserve_lane_command_execute_open_property_exit_gate');
break;
}
// Execute the command
@@ -1193,84 +1185,6 @@ class moduleSelfServeRoute
$lane->setShellyTransportOverride($transport);
}
private function requirePropertyGateCommandPermission(string $permission, selfserve_lane $lane, int $customer_number): void
{
if (self::hasPermission($permission)) {
return;
}
if ($this->canCustomerUsePropertyGateForLane($lane, $customer_number)) {
return;
}
self::requirePermission($permission);
}
protected function canCustomerUsePropertyGateForLane(selfserve_lane $lane, int $customer_number): bool
{
if ($customer_number <= 0) {
return false;
}
$department_id = (int)$lane->department_lane?->department?->value();
if ($department_id <= 0) {
return false;
}
return $this->customerHasActiveSelfServeWashInDepartment($department_id, $customer_number);
}
protected function customerHasActiveSelfServeWashInDepartment(int $department_id, int $customer_number): bool
{
if ($department_id <= 0 || $customer_number <= 0) {
return false;
}
$active_statuses = array_map(
static fn(selfserve_wash_session_status $status): string => $status->value,
[
selfserve_wash_session_status::MACHINE_RELAY_ENABLED,
selfserve_wash_session_status::READY_FOR_MACHINE_START,
selfserve_wash_session_status::MACHINE_STARTED,
selfserve_wash_session_status::PENDING_QUESTIONS,
selfserve_wash_session_status::MACHINE_NOT_ALLOWED,
]
);
$sessions = (new selfserve_wash_sessions_o())->getFieldsWhere([
'department_id' => $department_id,
'customer_number' => $customer_number,
'completed_at' => null,
'deleted_at' => null,
], ['id', 'status']);
foreach ($sessions as $session) {
if (in_array((string)($session['status'] ?? ''), $active_statuses, true)) {
return true;
}
}
foreach ((new department_lanes_o())->getDepartmentLanes($department_id) as $department_lane) {
try {
$lane = (new selfserve())->lane((int)$department_lane->id);
if ((int)$lane->getCustomerNumber() !== $customer_number) {
continue;
}
if (
$lane->getLaneStatus()->equals(selfserve_lane_status::OCCUPIED)
|| $lane->getLaneState()->equals(selfserve_lane_state::IN_WASH)
) {
return true;
}
} catch (\Throwable) {
continue;
}
}
return false;
}
private function requestedShellyTransportOverride(): ?string
{
$transport = null;