copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Harden self-serve lane mutation authorization

Browse Source
This commit is contained in:
Jeppe B
2026-05-28 19:23:31 +02:00
parent 1504f1b116
commit b13abe0d30
1 changed files with 3 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/moduleSelfServeRoute.php
+3 -12
View File
@@ -422,7 +422,7 @@ class moduleSelfServeRoute
$lane,
$customer_number,
'modules_selfserve_lane_command_execute_start',
true
false
);
break;
case selfserve_lane_command::STOP:
@@ -545,11 +545,7 @@ class moduleSelfServeRoute
// Build allowed services from provided tasks
$lane = $selfserve->lane($lane_id);
$customer_number = $this->resolveEffectiveCustomerNumber();
$this->requireSelfServeLaneAccess(
$lane,
$customer_number === null ? 0 : (int)$customer_number,
['modules_selfserve_lane_services_set_allowed']
);
self::requirePermission('modules_selfserve_lane_services_set_allowed');
$allowed_services = [];
foreach ($task_ids as $tid) {
if ($tid <= 0) continue;
@@ -882,12 +878,7 @@ class moduleSelfServeRoute
}
$lane = $selfserve->lane($lane_id);
$customer_number = $this->resolveEffectiveCustomerNumber();
$this->requireSelfServeLaneAccess(
$lane,
$customer_number === null ? 0 : (int)$customer_number,
['modules_selfserve_lane_relay_enable_machine'],
true
);
self::requirePermission('modules_selfserve_lane_relay_enable_machine');
try {
$this->applyShellyTransportOverride($lane);
$lane->turnOnRelay(selfserve_lane_relay::MACHINE, $duration);