← All changes | app/Http/Policies/MeetingPolicy.php +11 -9 2.2.0 → 2.5.0 View file →

		@@ -24,9 +24,9 @@
24	24	// Authorize only against the URL route parameter so request-body
25	25	// values cannot override the resource being acted on.
26	26	$bookingId = $this->getRouteBookingId($request);
27	27
28		- if ($request->method() == 'GET') {
	28	+ if ($request->getMethod() == 'GET') {
29	29	if (PermissionManager::userCan(['manage_own_calendar','read_all_bookings'])) {
30	30	return true;
31	31	}
32	32
		@@ -69,8 +69,13 @@
69	69	{
70	70	return $this->authorizeBookingAccess($request);
71	71	}
72	72
	73	+ public function getNotes(Request $request)
	74	+ {
	75	+ return $this->authorizeBookingAccess($request);
	76	+ }
	77	+
73	78	public function getBookingMetaInfo(Request $request)
74	79	{
75	80	return $this->authorizeBookingAccess($request);
76	81	}
		@@ -114,13 +119,11 @@
114	119	return $this->hasBookingAccess($booking);
115	120	}
116	121
117	122	/**
118		- * Resolve the booking ID from the URL route parameter only.
119		- *
120		- * Why: merged request inputs let JSON body values shadow URL params,
121		- * which previously allowed authorizing against an attacker-owned ID
122		- * while the controller acted on the URL-targeted victim ID.
	123	+ * Resolve the booking ID from the URL route parameter only. Merged inputs
	124	+ * let a body value shadow the URL, so a check could pass on one ID while
	125	+ * the controller acts on another.
123	126	*/
124	127	private function getRouteBookingId(Request $request)
125	128	{
126	129	return $this->getRouteParam($request, 'id');
		@@ -126,11 +129,10 @@
126	129	return $this->getRouteParam($request, 'id');
127	130	}
128	131
129	132	/**
130		- * Read a URL-only route parameter safely. Routes such as /schedules/
131		- * and /schedules/export have no path placeholders, so a direct
132		- * access would emit an undefined-array-key warning under PHP 8.
	133	+ * Read a URL route parameter. Some routes (/schedules/, /schedules/export)
	134	+ * have no placeholder, so direct access would warn under PHP 8.
133	135	*/
134	136	private function getRouteParam(Request $request, $key)
135	137	{
136	138	$params = (array) $request->get_url_params();