← All changes | app/Services/Integrations/FormIntegrationService.php +10 -4 6.2.4 → 6.2.14 View file →

		@@ -249,12 +249,18 @@
249	249	}
250	250
251	251	public function delete($id, $formId = null)
252	252	{
253		- $query = FormMeta::where('id', $id);
254		- if ($formId) {
255		- $query->where('form_id', $formId);
	253	+ // SECURITY (FINDING-10): a non-numeric route form id (e.g. /integrations/abc) made
	254	+ // the caller-supplied $formId falsy, which previously dropped the form_id predicate
	255	+ // and deleted an arbitrary fluentform_form_meta row cross-form. Fail closed: require
	256	+ // a positive form id and always scope the delete to it, so a meta row is only ever
	257	+ // removed when it belongs to the authorized form.
	258	+ $id = (int) $id;
	259	+ $formId = (int) $formId;
	260	+ if ($id < 1 || $formId < 1) {
	261	+ return;
256	262	}
257		- $query->delete();
	263	+ FormMeta::where('id', $id)->where('form_id', $formId)->delete();
258	264	}
259	265
260	266	}