copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #207 from copenhagentruckwash/fix-order-item-update-idor-vulnerability

Browse Source 
Enforce tenant ownership check for PUT /order/items to prevent IDOR
This commit is contained in:
Jeppe B
2026-06-01 22:59:03 +02:00
committed by GitHub
parent 7436584598 c79219eb00
commit 828c177a57
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/orderItemsRoute.php
+12
View File
@@ -211,6 +211,7 @@ class orderItemsRoute
if (!isset($data['quantity'])) {
$response->error('Quantity is required', 400);
}
$orderItem = (new order_items_o())->getOrderItemById((int)$data['id']);
if (!$orderItem->exists()) {
$response->error('Order item not found', 404);
@@ -219,6 +220,17 @@ class orderItemsRoute
if ($product->requiresOrderItemNote() && trim((string)$data['notes']) === '') {
$response->error('Notes is required for this product', 400);
}
$order = (new orders_o())->getOrderById((int)$orderItem->order_id->value());
if (!$order->exists()) {
$response->error('Order not found', 404);
}
$canAccessAllOrderItems = $this->hasPermission('list_order_items');
if (!$canAccessAllOrderItems && !$order->isOwnOrder((int)$user->customer_number->value())) {
$response->error('Order item does not belong to the user', 403);
}
// Update the order item
(new order_items_o())->updateOrderItem((int)$data['id'], (int)$data['price'], (string)$data['notes'], (string)$data['reference'], (int)$data['quantity']);
// Log the incident