Skip to content

Commit 04be108

Browse files
daveearleydaveearley
authored
SSRF / IDOR fixes (#984)
1 parent 5147240 commit 04be108

10 files changed

Lines changed: 75 additions & 21 deletions

File tree

‎backend/app/Http/Actions/Orders/GetOrderAction.php‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,10 @@
44

55
use HiEvents\DomainObjects\AttendeeDomainObject;
66
use HiEvents\DomainObjects\EventDomainObject;
7+
use HiEvents\DomainObjects\Generated\OrderDomainObjectAbstract;
78
use HiEvents\DomainObjects\OrderItemDomainObject;
89
use HiEvents\DomainObjects\QuestionAndAnswerViewDomainObject;
10+
use HiEvents\Exceptions\ResourceNotFoundException;
911
use HiEvents\Http\Actions\BaseAction;
1012
use HiEvents\Repository\Eloquent\Value\OrderAndDirection;
1113
use HiEvents\Repository\Eloquent\Value\Relationship;
@@ -22,6 +24,9 @@ public function __construct(OrderRepositoryInterface $orderRepository)
2224
$this->orderRepository = $orderRepository;
2325
}
2426

27+
/**
28+
* @throws ResourceNotFoundException
29+
*/
2530
public function __invoke(int $eventId, int $orderId): JsonResponse
2631
{
2732
$this->isActionAuthorized($eventId, EventDomainObject::class);
@@ -32,7 +37,14 @@ public function __invoke(int $eventId, int $orderId): JsonResponse
3237
->loadRelation(new Relationship(domainObject: QuestionAndAnswerViewDomainObject::class, orderAndDirections: [
3338
new OrderAndDirection(order: 'question_id'),
3439
]))
35-
->findById($orderId);
40+
->findFirstWhere([
41+
OrderDomainObjectAbstract::ID => $orderId,
42+
OrderDomainObjectAbstract::EVENT_ID => $eventId,
43+
]);
44+
45+
if ($order === null) {
46+
throw new ResourceNotFoundException(__('Order not found'));
47+
}
3648

3749
return $this->resourceResponse(OrderResource::class, $order);
3850
}

‎backend/app/Http/Actions/Questions/GetQuestionAction.php‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,9 @@
33
namespace HiEvents\Http\Actions\Questions;
44

55
use HiEvents\DomainObjects\EventDomainObject;
6+
use HiEvents\DomainObjects\Generated\QuestionDomainObjectAbstract;
67
use HiEvents\DomainObjects\ProductDomainObject;
8+
use HiEvents\Exceptions\ResourceNotFoundException;
79
use HiEvents\Http\Actions\BaseAction;
810
use HiEvents\Repository\Interfaces\QuestionRepositoryInterface;
911
use HiEvents\Resources\Question\QuestionResource;
@@ -19,14 +21,24 @@ public function __construct(QuestionRepositoryInterface $questionRepository)
1921
$this->questionRepository = $questionRepository;
2022
}
2123

24+
/**
25+
* @throws ResourceNotFoundException
26+
*/
2227
public function __invoke(Request $request, int $eventId, int $questionId): JsonResponse
2328
{
2429
$this->isActionAuthorized($eventId, EventDomainObject::class);
2530

26-
$questions = $this->questionRepository
31+
$question = $this->questionRepository
2732
->loadRelation(ProductDomainObject::class)
28-
->findById($questionId);
33+
->findFirstWhere([
34+
QuestionDomainObjectAbstract::ID => $questionId,
35+
QuestionDomainObjectAbstract::EVENT_ID => $eventId,
36+
]);
2937

30-
return $this->resourceResponse(QuestionResource::class, $questions);
38+
if ($question === null) {
39+
throw new ResourceNotFoundException(__('Question not found'));
40+
}
41+
42+
return $this->resourceResponse(QuestionResource::class, $question);
3143
}
3244
}

‎backend/app/Services/Application/Handlers/Attendee/PartialEditAttendeeHandler.php‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,14 @@ private function adjustEventStatistics(PartialEditAttendeeDTO $data, AttendeeDom
102102
{
103103
if ($data->status === AttendeeStatus::CANCELLED->name) {
104104
// Get the order to access the creation date for daily statistics
105-
$order = $this->orderRepository->findById($attendee->getOrderId());
105+
$order = $this->orderRepository->findFirstWhere([
106+
'id' => $attendee->getOrderId(),
107+
'event_id' => $attendee->getEventId(),
108+
]);
109+
110+
if ($order === null) {
111+
return;
112+
}
106113

107114
$this->eventStatisticsCancellationService->decrementForCancelledAttendee(
108115
eventId: $attendee->getEventId(),

‎backend/app/Services/Application/Handlers/Event/UpdateEventStatusHandler.php‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,20 @@ private function updateEventStatus(UpdateEventStatusDTO $updateEventStatusDTO):
4949

5050
$this->eventRepository->updateWhere(
5151
attributes: ['status' => $updateEventStatusDTO->status],
52-
where: ['id' => $updateEventStatusDTO->eventId]
52+
where: [
53+
'id' => $updateEventStatusDTO->eventId,
54+
'account_id' => $updateEventStatusDTO->accountId,
55+
]
5356
);
5457

5558
$this->logger->info('Event status updated', [
5659
'eventId' => $updateEventStatusDTO->eventId,
5760
'status' => $updateEventStatusDTO->status
5861
]);
5962

60-
return $this->eventRepository->findById($updateEventStatusDTO->eventId);
63+
return $this->eventRepository->findFirstWhere([
64+
'id' => $updateEventStatusDTO->eventId,
65+
'account_id' => $updateEventStatusDTO->accountId,
66+
]);
6167
}
6268
}

‎backend/app/Services/Application/Handlers/Organizer/EditOrganizerHandler.php‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@ private function editOrganizer(EditOrganizerDTO $organizerData): OrganizerDomain
5151

5252
return $this->organizerRepository
5353
->loadRelation(ImageDomainObject::class)
54-
->findById($organizerData->id);
54+
->findFirstWhere([
55+
'id' => $organizerData->id,
56+
'account_id' => $organizerData->account_id,
57+
]);
5558
}
5659
}

‎backend/app/Services/Application/Handlers/Organizer/UpdateOrganizerStatusHandler.php‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,14 +48,20 @@ private function updateOrganizerStatus(UpdateOrganizerStatusDTO $updateOrganizer
4848

4949
$this->organizerRepository->updateWhere(
5050
attributes: ['status' => $updateOrganizerStatusDTO->status],
51-
where: ['id' => $updateOrganizerStatusDTO->organizerId]
51+
where: [
52+
'id' => $updateOrganizerStatusDTO->organizerId,
53+
'account_id' => $updateOrganizerStatusDTO->accountId,
54+
]
5255
);
5356

5457
$this->logger->info('Organizer status updated', [
5558
'organizerId' => $updateOrganizerStatusDTO->organizerId,
5659
'status' => $updateOrganizerStatusDTO->status
5760
]);
5861

59-
return $this->organizerRepository->findById($updateOrganizerStatusDTO->organizerId);
62+
return $this->organizerRepository->findFirstWhere([
63+
'id' => $updateOrganizerStatusDTO->organizerId,
64+
'account_id' => $updateOrganizerStatusDTO->accountId,
65+
]);
6066
}
6167
}

‎backend/app/Services/Application/Handlers/ProductCategory/EditProductCategoryHandler.php‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ public function handle(UpsertProductCategoryDTO $dto): ProductCategoryDomainObje
2929
],
3030
);
3131

32-
return $this->productCategoryRepository->findById($dto->product_category_id);
32+
return $this->productCategoryRepository->findFirstWhere([
33+
'id' => $dto->product_category_id,
34+
'event_id' => $dto->event_id,
35+
]);
3336
}
3437
}

‎backend/app/Services/Application/Handlers/TaxAndFee/EditTaxHandler.php‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,10 @@ public function handle(UpsertTaxDTO $data): TaxAndFeesDomainObject
6161
);
6262

6363
/** @var TaxAndFeesDomainObject $tax */
64-
$tax = $this->taxRepository->findById($data->id);
64+
$tax = $this->taxRepository->findFirstWhere([
65+
'id' => $data->id,
66+
'account_id' => $data->account_id,
67+
]);
6568

6669
$this->logger->info('Updated tax', [
6770
'id' => $tax->getId(),

‎backend/app/Services/Application/Handlers/User/CancelEmailChangeHandler.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
namespace HiEvents\Services\Application\Handlers\User;
44

55
use HiEvents\DomainObjects\UserDomainObject;
6+
use HiEvents\Exceptions\ResourceNotFoundException;
67
use HiEvents\Repository\Interfaces\UserRepositoryInterface;
78
use HiEvents\Services\Application\Handlers\User\DTO\CancelEmailChangeDTO;
89
use Psr\Log\LoggerInterface;
@@ -24,6 +25,12 @@ public function __construct(
2425

2526
public function handle(CancelEmailChangeDTO $data): UserDomainObject
2627
{
28+
$user = $this->userRepository->findByIdAndAccountId($data->userId, $data->accountId);
29+
30+
if ($user === null) {
31+
throw new ResourceNotFoundException(__('User not found'));
32+
}
33+
2734
$this->userRepository->updateWhere(
2835
attributes: [
2936
'pending_email' => null,

‎backend/app/Services/Application/Handlers/User/UpdateMeHandler.php‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -88,15 +88,10 @@ private function isChangingEmail(UpdateMeDTO $updateUserData, UserDomainObject $
8888

8989
private function getExistingUser(UpdateMeDTO $updateUserData): UserDomainObject
9090
{
91-
$existingUser = $this->userRepository->findFirstWhere([
92-
'id' => $updateUserData->id,
93-
]);
94-
95-
if ($existingUser === null) {
96-
throw new ResourceNotFoundException();
97-
}
98-
99-
return $existingUser;
91+
return $this->userRepository->findByIdAndAccountId(
92+
$updateUserData->id,
93+
$updateUserData->account_id
94+
);
10095
}
10196

10297
private function sendEmailChangeConfirmation(UserDomainObject $existingUser): void

0 commit comments

Comments
 (0)