← All changes | app/Http/Controllers/FormSettingsController.php +15 -1 6.2.8 → 6.2.14 View file →

		@@ -2,8 +2,9 @@
2	2
3	3	namespace FluentForm\App\Http\Controllers;
4	4
5	5	use Exception;
	6	+use FluentForm\App\Modules\Acl\Acl;
6	7	use FluentForm\App\Services\Settings\Customizer;
7	8	use FluentForm\App\Services\Settings\SettingsService;
8	9	use FluentForm\Framework\Validator\ValidationException;
9	10	use FluentForm\App\Services\Submission\SubmissionService;
		@@ -11,10 +12,23 @@
11	12	class FormSettingsController extends Controller
12	13	{
13	14	public function index(SettingsService $settingsService, $formId)
14	15	{
	16	+ $formId = (int) $formId;
	17	+
	18	+ // SECURITY (FINDING-09): this endpoint returns arbitrary form_meta by meta_key —
	19	+ // including integration feeds that hold webhook Authorization headers/credentials.
	20	+ // Because the method name collides with the forms-list controller, it resolved to
	21	+ // FormPolicy@index (fluentform_dashboard_access, the lowest tier). Require the
	22	+ // forms-manager capability, scoped to this form, to read its settings/meta.
	23	+ if (!Acl::hasPermission('fluentform_forms_manager', $formId)) {
	24	+ return $this->sendError([
	25	+ 'message' => __('You do not have permission to view these settings.', 'fluentform'),
	26	+ ], 403);
	27	+ }
	28	+
15	29	$attributes = $this->request->all();
16		- $attributes['form_id'] = (int) $formId;
	30	+ $attributes['form_id'] = $formId;
17	31
18	32	$result = $settingsService->get($attributes);
19	33
20	34	return $this->sendSuccess($result);