copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #201 from copenhagentruckwash/fix-idor-vulnerability-in-attachment-endpoints

Browse Source 
Ensure attachment belongs to task before download/delete (fix IDOR)
This commit is contained in:
Jeppe B
2026-06-01 22:48:14 +02:00
committed by GitHub
parent b16a07fdbb a5019efbda
commit d9a36e4050
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/departmentSelfserveTasksRoute.php
+11 -2
View File
@@ -493,11 +493,14 @@ class departmentSelfserveTasksRoute
}
}
$attachment = $task_o->getAttachment($attachment_id);
if (!$attachment->exists()) {
$task_attachments = $task_o->listAttachments();
$task_attachment_ids = array_map(static fn($attachment) => (int)$attachment->id, $task_attachments);
if (!in_array($attachment_id, $task_attachment_ids, true)) {
$response->error('Attachment not found', 404);
}
$attachment = $task_o->getAttachment($attachment_id);
$attachment_store = new attachment_store();
$attachments = new attachments();
$attachment_formatted = $attachments->format($attachment);
@@ -620,6 +623,12 @@ class departmentSelfserveTasksRoute
$this->forbidDepartmentAccess((int)$task_o->department->value());
}
$task_attachments = $task_o->listAttachments();
$task_attachment_ids = array_map(static fn($attachment) => (int)$attachment->id, $task_attachments);
if (!in_array($attachment_id, $task_attachment_ids, true)) {
$response->error('Attachment not found', 404);
}
$task_o->removeAttachment($attachment_id);
(new logs_o())->add('department_selfserve_tasks', (int)$task_o->department->value(), 1, $user->id, 'DELETE_TASK_ATTACHMENT', 'User deleted attachment ID: ' . $attachment_id . ' for task ID: ' . $task_id);