copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #261 from copenhagentruckwash/fix-customer-data-leak-in-wash-endpoint

Browse Source 
Restrict in-progress wash details by lane department
This commit is contained in:
Jeppe B
2026-06-02 00:20:07 +02:00
committed by GitHub
parent 434a5049e2 7380bc729b
commit c13c2e2cab
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/moduleSelfServeRoute.php
+7 -2
View File
@@ -124,7 +124,7 @@ class moduleSelfServeRoute
$lane_id = (int)$this->getParameter('lane_id');
self::requireType($lane_id, self::type_int());
self::requireMinValue($lane_id, 1);
$customer_scope = $this->requireInProgressWashDetailsAccess();
$customer_scope = $this->requireInProgressWashDetailsAccess($lane_id);
$build_customer = static function (?int $customer_number): ?array {
if ($customer_number === null || $customer_number <= 0) {
@@ -1228,7 +1228,7 @@ class moduleSelfServeRoute
]);
}
private function requireInProgressWashDetailsAccess(): ?int
private function requireInProgressWashDetailsAccess(int $lane_id): ?int
{
global $response;
@@ -1238,6 +1238,11 @@ class moduleSelfServeRoute
}
if (self::hasPermission('modules_selfserve_lane_wash_in_progress_view')) {
$department_lane = (new department_lanes_o())->select($lane_id);
if (!$department_lane->exists()) {
$response->error('Department lane not found', 404);
}
self::requireDepartmentAccess((string)$department_lane->department->value());
return null;
}
services/nginx/app/tests/Unit/Selfserve/SelfserveRouteWiringTest.php
+3 -1
View File
@@ -288,7 +288,9 @@ it('wires in-progress self-serve wash details endpoint', function (): void {
expect($moduleSelfServeRoute)->toContain('/modules/self-serve/lane/wash/in-progress');
expect($moduleSelfServeRoute)->toContain('modules_selfserve_lane_wash_in_progress_view');
expect($moduleSelfServeRoute)->toContain('list_own_department_selfserve_vehicle_conditions');
expect($moduleSelfServeRoute)->toContain('requireInProgressWashDetailsAccess');
expect($moduleSelfServeRoute)->toContain('requireInProgressWashDetailsAccess($lane_id)');
expect($moduleSelfServeRoute)->toContain('(new department_lanes_o())->select($lane_id)');
expect($moduleSelfServeRoute)->toContain('self::requireDepartmentAccess((string)$department_lane->department->value())');
expect($moduleSelfServeRoute)->toContain('scopeInProgressWashResponseForCustomer');
expect($moduleSelfServeRoute)->toContain("'in_progress' => true");
expect($moduleSelfServeRoute)->toContain("'in_progress' => false");