copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Fix task attachment IDOR in self-serve endpoints

Browse Source
This commit is contained in:
Jeppe B
2026-06-01 22:48:04 +02:00
parent d82c7d88ec
commit a5019efbda
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/departmentSelfserveTasksRoute.php
+11 -2
View File
@@ -384,11 +384,14 @@ class departmentSelfserveTasksRoute
}
}
$attachment = $task_o->getAttachment($attachment_id);
if (!$attachment->exists()) {
$task_attachments = $task_o->listAttachments();
$task_attachment_ids = array_map(static fn($attachment) => (int)$attachment->id, $task_attachments);
if (!in_array($attachment_id, $task_attachment_ids, true)) {
$response->error('Attachment not found', 404);
}
$attachment = $task_o->getAttachment($attachment_id);
$attachment_store = new attachment_store();
$attachments = new attachments();
$attachment_formatted = $attachments->format($attachment);
@@ -511,6 +514,12 @@ class departmentSelfserveTasksRoute
$response->error('You do not have access to this department', 403);
}
$task_attachments = $task_o->listAttachments();
$task_attachment_ids = array_map(static fn($attachment) => (int)$attachment->id, $task_attachments);
if (!in_array($attachment_id, $task_attachment_ids, true)) {
$response->error('Attachment not found', 404);
}
$task_o->removeAttachment($attachment_id);
(new logs_o())->add('department_selfserve_tasks', (int)$task_o->department->value(), 1, $user->id, 'DELETE_TASK_ATTACHMENT', 'User deleted attachment ID: ' . $attachment_id . ' for task ID: ' . $task_id);