improve permissison handling in invoice screen (#2965)

src/Repository/CustomerRepository.php

@@ -241,7 +241,8 @@ class CustomerRepository extends EntityRepository
 
         $outerQuery = $qb->expr()->orX();
 
-        if ($query->hasCustomers()) {
+        // this is a risk, as a user can manipulate the query and inject IDs that would be hidden otherwise
+        if ($query->isAllowCustomerPreselect() && $query->hasCustomers()) {
             $outerQuery->add($qb->expr()->in('c.id', ':customer'));
             $qb->setParameter('customer', $query->getCustomers());
         }

src/Repository/Query/CustomerFormTypeQuery.php

@@ -20,6 +20,7 @@ final class CustomerFormTypeQuery extends BaseFormTypeQuery
      * @var Customer|null
      */
     private $customerToIgnore;
+    private $allowCustomerPreselect = false;
 
     /**
      * @param Customer|int|null $customer
@@ -34,6 +35,16 @@ final class CustomerFormTypeQuery extends BaseFormTypeQuery
         }
     }
 
+    public function isAllowCustomerPreselect(): bool
+    {
+        return $this->allowCustomerPreselect;
+    }
+
+    public function setAllowCustomerPreselect(bool $allowCustomerPreselect): void
+    {
+        $this->allowCustomerPreselect = $allowCustomerPreselect;
+    }
+
     /**
      * @return Customer|null
      */