copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Validate invoice collection ownership when updating orders

Browse Source
This commit is contained in:
Jeppe B
2026-06-01 22:51:09 +02:00
parent 4945abfd8e
commit bf8262b64f
1 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/ordersRoute.php
+15 -2
View File
@@ -942,6 +942,9 @@ class ordersRoute
}
$order->customer_id->set((int)$data['customer_id']);
}
$targetCustomerNumber = isset($data['customer_id'])
? (int)$data['customer_id']
: (int)$order->customer_id->value();
// If the reference is set, validate it
if (isset($data['reference'])) {
$order->reference->set($data['reference']);
@@ -983,7 +986,17 @@ class ordersRoute
}
// Check if the invoice collection is set
if (isset($data['invoice_collection_id'])) {
$order->invoice_collection_id->set((int)$data['invoice_collection_id']);
$invoiceCollectionId = (int)$data['invoice_collection_id'];
if ($invoiceCollectionId > 0) {
$invoiceCollection = (new collected_order_invoices_o())->select($invoiceCollectionId);
if (!$invoiceCollection->exists()) {
$response->error('Invoice collection not found', 400);
}
if ((int)$invoiceCollection->customer_number->value() !== $targetCustomerNumber) {
$response->error('Invoice collection does not belong to the order customer', 400);
}
}
$order->invoice_collection_id->set($invoiceCollectionId);
}
// Check if the wash_id is set
if (isset($data['wash_id'])) {
@@ -1038,4 +1051,4 @@ class ordersRoute
// Optional fields are not checked here, as they are optional and can be empty
return $data;
}
}
}