improve permissison handling in invoice screen (#2965)

2021-11-21 16:41:03 +01:00
parent 76e09447c8
commit ff9acab0fc
15 changed files with 183 additions and 124 deletions
--- a/src/Repository/CustomerRepository.php
+++ b/src/Repository/CustomerRepository.php
@@ -241,7 +241,8 @@ class CustomerRepository extends EntityRepository

        $outerQuery = $qb->expr()->orX();

-        if ($query->hasCustomers()) {
+        // this is a risk, as a user can manipulate the query and inject IDs that would be hidden otherwise
+        if ($query->isAllowCustomerPreselect() && $query->hasCustomers()) {
            $outerQuery->add($qb->expr()->in('c.id', ':customer'));
            $qb->setParameter('customer', $query->getCustomers());
        }