copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #198 from copenhagentruckwash/fix-lane-ownership-validation-for-commands

Browse Source 
Enforce department scoping for self-serve lane command route
This commit is contained in:
Jeppe B
2026-06-01 22:45:23 +02:00
committed by GitHub
parent ba9c4d3b9f 64fc70a0a8
commit b11b38a95b
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/moduleSelfServeRoute.php
+5
View File
@@ -459,6 +459,11 @@ class moduleSelfServeRoute
self::requireType($commandParam, self::type_string());
// Get the lane and command
$lane = $selfserve->lane($lane_id);
// Require access to the lane's department to prevent cross-department command execution
if (empty($lane->department_lane) || empty($lane->department_lane->department)) {
$response->error('Lane department not found', 404);
}
self::requireDepartmentAccess((string)$lane->department_lane->department->value());
// If the user has the bypass permission, set the lane to bypass customer number validation
if (self::hasPermission('modules_selfserve_lane_command_bypass_customer_number_validation')) {
$lane->setBypassCustomerNumberValidation(true);