Merge pull request #189 from copenhagentruckwash/fix-subuser-token-authorization-vulnerability

Validate subuser grants before resolving subuser customer context

services/nginx/app/classes/authentication.php

@@ -6,6 +6,7 @@ use classes\totp;
 use Exception;
 use interfaces\authentication_i;
 use objects\plate_scanners_o;
+use objects\subuser_grants_o;
 use objects\tokens_o;
 use objects\users_o;
 use objects\subusers_o;
@@ -165,6 +166,15 @@ class authentication implements authentication_i
                 return false;
             }
             $customer_number = (int)$headers['X-Customer-Number'];
+            // Resolve and validate subuser grant for the requested customer context
+            $subuser = (new subusers_o())->getSubuserBySessionToken($token->token->value());
+            if ($subuser === null) {
+                return false;
+            }
+            $grants = (new subuser_grants_o())->getGrantsForSubuserAndCustomer((int)$subuser->id, $customer_number);
+            if (count($grants) === 0) {
+                return false;
+            }
             // Get the user by the customer number
             return (new users_o())->getUserByCustomerNumber($customer_number);
         }