← All changes | app/Http/Policies/MeetingPolicy.php +33 -9 2.1.2 → 2.5.0 View file →

		@@ -24,9 +24,9 @@
24	24	// Authorize only against the URL route parameter so request-body
25	25	// values cannot override the resource being acted on.
26	26	$bookingId = $this->getRouteBookingId($request);
27	27
28		- if ($request->method() == 'GET') {
	28	+ if ($request->getMethod() == 'GET') {
29	29	if (PermissionManager::userCan(['manage_own_calendar','read_all_bookings'])) {
30	30	return true;
31	31	}
32	32
		@@ -69,13 +69,40 @@
69	69	{
70	70	return $this->authorizeBookingAccess($request);
71	71	}
72	72
	73	+ public function getNotes(Request $request)
	74	+ {
	75	+ return $this->authorizeBookingAccess($request);
	76	+ }
	77	+
73	78	public function getBookingMetaInfo(Request $request)
74	79	{
75	80	return $this->authorizeBookingAccess($request);
76	81	}
77	82
	83	+ public function getCrmContact(Request $request)
	84	+ {
	85	+ return $this->authorizeBookingAccess($request);
	86	+ }
	87	+
	88	+ public function getCrmOptions(Request $request)
	89	+ {
	90	+ return $this->authorizeBookingAccess($request);
	91	+ }
	92	+
	93	+ // State-changing: use verifyRequest so read-only roles (read_all_bookings)
	94	+ // cannot mutate CRM data; only host access or manage_all_* passes for POST.
	95	+ public function updateCrmTags(Request $request)
	96	+ {
	97	+ return $this->verifyRequest($request);
	98	+ }
	99	+
	100	+ public function updateCrmLists(Request $request)
	101	+ {
	102	+ return $this->verifyRequest($request);
	103	+ }
	104	+
78	105	private function authorizeBookingAccess(Request $request)
79	106	{
80	107	if (PermissionManager::userCan(['manage_all_bookings', 'manage_all_data', 'read_all_bookings'])) {
81	108	return true;
		@@ -92,13 +119,11 @@
92	119	return $this->hasBookingAccess($booking);
93	120	}
94	121
95	122	/**
96		- * Resolve the booking ID from the URL route parameter only.
97		- *
98		- * Why: merged request inputs let JSON body values shadow URL params,
99		- * which previously allowed authorizing against an attacker-owned ID
100		- * while the controller acted on the URL-targeted victim ID.
	123	+ * Resolve the booking ID from the URL route parameter only. Merged inputs
	124	+ * let a body value shadow the URL, so a check could pass on one ID while
	125	+ * the controller acts on another.
101	126	*/
102	127	private function getRouteBookingId(Request $request)
103	128	{
104	129	return $this->getRouteParam($request, 'id');
		@@ -104,11 +129,10 @@
104	129	return $this->getRouteParam($request, 'id');
105	130	}
106	131
107	132	/**
108		- * Read a URL-only route parameter safely. Routes such as /schedules/
109		- * and /schedules/export have no path placeholders, so a direct
110		- * access would emit an undefined-array-key warning under PHP 8.
	133	+ * Read a URL route parameter. Some routes (/schedules/, /schedules/export)
	134	+ * have no placeholder, so direct access would warn under PHP 8.
111	135	*/
112	136	private function getRouteParam(Request $request, $key)
113	137	{
114	138	$params = (array) $request->get_url_params();