copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #200 from copenhagentruckwash/fix-subuser-permission-vulnerability

Browse Source 
Harden subuser permission customer context resolution
This commit is contained in:
Jeppe B
2026-06-01 22:46:50 +02:00
committed by GitHub
parent 65283b8ad7 ca02fd3436
commit b16a07fdbb
1 changed files with 4 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/traits/route_t.php
+4 -12
View File
@@ -297,8 +297,10 @@ trait route_t
* Order of precedence:
* - Explicit `$customer_number` argument if provided
* - Main authenticated user context (if available)
* - Request header X-Customer-Number
* - Query/post parameter `customer_number`
*
* Important: never derive this value from caller-controlled request
* headers/parameters at this layer. Route handlers must pass a trusted
* customer number that is bound to the target resource when needed.
*/
private function resolveCustomerNumberForSubuser(authentication $auth, ?int $customer_number = null): ?int
{
@@ -309,16 +311,6 @@ trait route_t
if ($user_ctx !== false && isset($user_ctx->customer_number)) {
return (int)$user_ctx->customer_number->value();
}
$headers = function_exists('getallheaders') ? getallheaders() : [];
if (isset($headers['X-Customer-Number'])) {
return (int)$headers['X-Customer-Number'];
}
if (isset($_GET['customer_number'])) {
return (int)$_GET['customer_number'];
}
if (isset($_POST['customer_number'])) {
return (int)$_POST['customer_number'];
}
return null;
}