copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #175 from copenhagentruckwash/fix-vulnerability-in-studio-graph-edits

Browse Source 
Fix authorization boundary for studio graph lane operations
This commit is contained in:
Jeppe B
2026-06-01 20:56:51 +02:00
committed by GitHub
parent 492c81e27c 31a7224272
commit f8f603a38e
2 changed files with 42 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/modules/selfserve/classes/selfserve_studio_graph.php
+40 -7
View File
@@ -342,7 +342,7 @@ class selfserve_studio_graph
if ($versioning->isV2Config($config)) {
foreach ($operations as $operation) {
if (is_array($operation)) {
$this->applyConfigOperation($departmentId, $config, $operation);
$this->applyConfigOperation($departmentId, $config, $operation, $permissions);
}
}
@@ -356,7 +356,7 @@ class selfserve_studio_graph
} else {
foreach ($operations as $operation) {
if (is_array($operation)) {
$this->applyOperation($departmentId, $operation);
$this->applyOperation($departmentId, $operation, $permissions);
}
}
}
@@ -1676,7 +1676,7 @@ class selfserve_studio_graph
* @param array<string,mixed> $config
* @param array<string,mixed> $operation
*/
private function applyConfigOperation(int $departmentId, array &$config, array $operation): void
private function applyConfigOperation(int $departmentId, array &$config, array $operation, array $permissions = []): void
{
$action = strtolower((string)($operation['action'] ?? ''));
$entity = $this->normalizeEntity((string)($operation['entity'] ?? $operation['type'] ?? ''));
@@ -1703,7 +1703,7 @@ class selfserve_studio_graph
throw new \RuntimeException('Studio graph operation is missing entity.');
}
if ($entity === 'lane') {
$this->applyLaneOperation($departmentId, $action, $id, $data);
$this->applyLaneOperation($departmentId, $action, $id, $data, $permissions);
return;
}
if ($entity === 'rule') {
@@ -2761,7 +2761,7 @@ class selfserve_studio_graph
/**
* @param array<string,mixed> $operation
*/
private function applyOperation(int $departmentId, array $operation): void
private function applyOperation(int $departmentId, array $operation, array $permissions = []): void
{
$action = strtolower((string)($operation['action'] ?? ''));
$entity = $this->normalizeEntity((string)($operation['entity'] ?? $operation['type'] ?? ''));
@@ -2784,7 +2784,7 @@ class selfserve_studio_graph
throw new \RuntimeException('Studio graph operation is missing entity.');
}
if ($entity === 'lane') {
$this->applyLaneOperation($departmentId, $action, $id, $data);
$this->applyLaneOperation($departmentId, $action, $id, $data, $permissions);
return;
}
@@ -2810,12 +2810,14 @@ class selfserve_studio_graph
/**
* @param array<string,mixed> $data
*/
private function applyLaneOperation(int $departmentId, string $action, int $id, array $data): void
private function applyLaneOperation(int $departmentId, string $action, int $id, array $data, array $permissions = []): void
{
if (!$this->tableExists('department_lanes')) {
throw new \RuntimeException('Department lanes are not available.');
}
$this->assertLaneOperationAuthorized($action, $data, $permissions);
if ($action === 'create') {
$this->createLane($departmentId, $data);
return;
@@ -2842,6 +2844,37 @@ class selfserve_studio_graph
throw new \RuntimeException('Unsupported studio lane operation: ' . $action);
}
/**
* @param array<string,mixed> $data
* @param array<string,bool> $permissions
*/
private function assertLaneOperationAuthorized(string $action, array $data, array $permissions): void
{
if ($action === 'create' && !($permissions['can_add_department_lane'] ?? false)) {
throw new \RuntimeException('Missing permission: add_department_lane.');
}
if (in_array($action, ['update', 'delete'], true) && !($permissions['can_edit_department_lane'] ?? false)) {
throw new \RuntimeException('Missing permission: edit_department_lane.');
}
if (!in_array($action, ['create', 'update'], true)) {
return;
}
$relayFields = [
'relay_in_id',
'relay_out_id',
'relay_machine_id',
'relay_machine_program_picker_id',
'relay_machine_cleaner_id',
];
foreach ($relayFields as $field) {
if (array_key_exists($field, $data) && !($permissions['modules_shelly_config'] ?? false)) {
throw new \RuntimeException('Missing permission: modules_shelly_config.');
}
}
}
/**
* @param array<string,mixed> $data
*/