copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #194 from copenhagentruckwash/fix-missing-department-authorization-for-payment-intents

Browse Source 
Require department access on Stripe payment-intent routes
This commit is contained in:
Jeppe B
2026-06-01 22:41:24 +02:00
committed by GitHub
parent b3225c8d8b 2782afde2e
commit fe6eae862f
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/ordersRoute.php
+3
View File
@@ -605,6 +605,7 @@ class ordersRoute
if (!$order->exists()) {
$response->error('Order not found', 400);
}
self::requireDepartmentAccess((int)$order->department_id->value());
$department = (new departments_o())->selectId((int)$order->department_id->value());
if (!$department->isStripeConfigured()) {
@@ -730,6 +731,7 @@ class ordersRoute
if (!$order->exists()) {
$response->error('Order not found', 400);
}
self::requireDepartmentAccess((int)$order->department_id->value());
$stripePaymentIntents = new stripe_payment_intents_o();
if (!$stripePaymentIntents->doesOrderHavePaymentIntent((int)$order->id)) {
@@ -788,6 +790,7 @@ class ordersRoute
if (!$order->exists()) {
$response->error('Order not found', 400);
}
self::requireDepartmentAccess((int)$order->department_id->value());
$stripePaymentIntents = new stripe_payment_intents_o();
if (!$stripePaymentIntents->doesOrderHavePaymentIntent((int)$order->id)) {