| @@ -1,8 +1,9 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | 3 | namespace FluentForm\App\Http\Controllers; |
| 4 | 4 | |
| 5 | +use FluentForm\App\Modules\Acl\Acl; | |
| 5 | 6 | use FluentForm\App\Services\Integrations\FormIntegrationService; |
| 6 | 7 | |
| 7 | 8 | class FormIntegrationController extends Controller |
| 8 | 9 | { |
| @@ -9,8 +10,16 @@ | ||
| 9 | 10 | public function index(FormIntegrationService $integrationService, $formId) |
| 10 | 11 | { |
| 11 | 12 | try { |
| 12 | 13 | $formId = (int) $formId; |
| 14 | + // SECURITY (FINDING-09): returns full integration feed configurations (webhook | |
| 15 | + // URLs, headers, credential-like fields). The shared `index` method name resolved | |
| 16 | + // to FormPolicy@index (dashboard_access); require forms-manager on this form. | |
| 17 | + if (!Acl::hasPermission('fluentform_forms_manager', $formId)) { | |
| 18 | + return $this->sendError([ | |
| 19 | + 'message' => __('You do not have permission to view these integrations.', 'fluentform'), | |
| 20 | + ], 403); | |
| 21 | + } | |
| 13 | 22 | return $this->sendSuccess( |
| 14 | 23 | $integrationService->get($formId) |
| 15 | 24 | ); |
| 16 | 25 | } catch (\Exception $e) { |
