CVE-2022-0203: Missing Authorization (CWE-862)
value: Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 5.3
Published: 2022-01-26T13:15Z
Repository: https://github.com/crater-invoice/crater
Language: PHP
Files changed: app/Http/Controllers/V1/Admin/Invoice/InvoicesController.php, app/Http/Controllers/V1/Admin/Payment/PaymentMethodsController.php, app/Http/Controllers/V1/PDF/DownloadReceiptController.php, app/Models/Invoice.php, app/Models/PaymentMethod.php
Commit date: 2022-01-13 12:23:26 +0530
Commit message: solve payment method delete issue

Diff: diff --git a/app/Http/Controllers/V1/Admin/Invoice/InvoicesController.php b/app/Http/Controllers/V1/Admin/Invoice/InvoicesController.php
index f1c7fd21..9aeefe51 100644
--- a/app/Http/Controllers/V1/Admin/Invoice/InvoicesController.php
+++ b/app/Http/Controllers/V1/Admin/Invoice/InvoicesController.php
@@ -100,11 +100,11 @@ class InvoicesController extends Controller
      */
     public function delete(DeleteInvoiceRequest $request)
     {
         $this->authorize('delete multiple invoices');
 
-        Invoice::destroy($request->ids);
+        Invoice::deleteInvoices($request->ids);
 
         return response()->json([
             'success' => true,
         ]);
     }
diff --git a/app/Http/Controllers/V1/Admin/Payment/PaymentMethodsController.php b/app/Http/Controllers/V1/Admin/Payment/PaymentMethodsController.php
index c4678516..53fbcb92 100644
--- a/app/Http/Controllers/V1/Admin/Payment/PaymentMethodsController.php
+++ b/app/Http/Controllers/V1/Admin/Payment/PaymentMethodsController.php
@@ -82,16 +82,18 @@ class PaymentMethodsController extends Controller
      */
     public function destroy(PaymentMethod $paymentMethod)
     {
         $this->authorize('delete', $paymentMethod);
 
-        $payments = $paymentMethod->payments;
-
-        if ($payments->count() > 0) {
+        if ($paymentMethod->payments()->exists()) {
             return respondJson('payments_attached', 'Payments Attached.');
         }
 
+        if ($paymentMethod->expenses()->exists()) {
+            return respondJson('expenses_attached', 'Expenses Attached.');
+        }
+
         $paymentMethod->delete();
 
         return response()->json([
             'success' => 'Payment method deleted successfully',
         ]);
diff --git a/app/Http/Controllers/V1/PDF/DownloadReceiptController.php b/app/Http/Controllers/V1/PDF/DownloadReceiptController.php
index b53c7f23..51f64692 100644
--- a/app/Http/Controllers/V1/PDF/DownloadReceiptController.php
+++ b/app/Http/Controllers/V1/PDF/DownloadReceiptController.php
@@ -15,10 +15,12 @@ class DownloadReceiptController extends Controller
      * @param   string $hash
      * @return \Illuminate\Http\Response
      */
     public function __invoke(Expense $expense)
     {
+        $this->authorize('view', $expense);
+
         if ($expense) {
             $media = $expense->getFirstMedia('receipts');
             if ($media) {
                 $imagePath = $media->getPath();
                 $response = \Response::download($imagePath, $media->file_name);
diff --git a/app/Models/Invoice.php b/app/Models/Invoice.php
index 57fa5200..e23c6eca 100644
--- a/app/Models/Invoice.php
+++ b/app/Models/Invoice.php
@@ -696,6 +696,21 @@ class Invoice extends Model implements HasMedia
             $this->paid_status = Invoice::STATUS_PARTIALLY_PAID;
         }
 
         $this->save();
     }
+
+    public static function deleteInvoices($ids)
+    {
+        foreach ($ids as $id) {
+            $invoice = self::find($id);
+
+            if ($invoice->transactions()->exists()) {
+                $invoice->transactions()->delete();
+            }
+
+            $invoice->delete();
+        }
+
+        return true;
+    }
 }
diff --git a/app/Models/PaymentMethod.php b/app/Models/PaymentMethod.php
index 898fbd36..23723c8d 100644
--- a/app/Models/PaymentMethod.php
+++ b/app/Models/PaymentMethod.php
@@ -29,10 +29,15 @@ class PaymentMethod extends Model
     public function payments()
     {
         return $this->hasMany(Payment::class);
     }
 
+    public function expenses()
+    {
+        return $this->hasMany(Expense::class);
+    }
+
     public function company()
     {
         return $this->belongsTo(Company::class);
     }
 

Vulnerable code:         Invoice::destroy($request->ids);
        $payments = $paymentMethod->payments;

        if ($payments->count() > 0) {
Fixed code:         Invoice::deleteInvoices($request->ids);
        if ($paymentMethod->payments()->exists()) {
        if ($paymentMethod->expenses()->exists()) {
            return respondJson('expenses_attached', 'Expenses Attached.');
        }

        $this->authorize('view', $expense);


    public static function deleteInvoices($ids)
    {
        foreach ($ids as $id) {
            $invoice = self::find($id);

            if ($invoice->transactions()->exists()) {
                $invoice->transactions()->delete();
            }

            $invoice->delete();
        }

        return true;
    }
    public function expenses()
    {
        return $this->hasMany(Expense::class);
    }