CVE-2022-22110: Weak Password Requirements (CWE-521)
value: In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort.
CWE description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
CVSS v3 base score: 7.5
Published: 2022-01-05T15:15Z
Repository: https://github.com/Bottelet/DaybydayCRM
Language: PHP
Files changed: app/Http/Controllers/AppointmentsController.php, app/Http/Requests/User/StoreUserRequest.php, app/Http/Requests/User/UpdateUserRequest.php
Commit date: 2021-06-25 21:31:54 +0200
Commit message: password change requires 6 on update, and only allowed users can see calendar

Diff: diff --git a/app/Http/Controllers/AppointmentsController.php b/app/Http/Controllers/AppointmentsController.php
index 619fc8c1..b15a1006 100644
--- a/app/Http/Controllers/AppointmentsController.php
+++ b/app/Http/Controllers/AppointmentsController.php
@@ -13,10 +13,14 @@ use Ramsey\Uuid\Uuid;
 
 class AppointmentsController extends Controller
 {
     public function calendar()
     {
+        if (!auth()->user()->can("calendar-view")) {
+            session()->flash('flash_message_warning', __('You do not have permission to view this page'));
+            return redirect()->back();
+        }
         return view('appointments.calendar');
     }
 
     public function appointmentsJson()
     {
@@ -36,11 +40,10 @@ class AppointmentsController extends Controller
         return response($appointment);
     }
 
     public function store(CreateAppointmentCalendarRequest $request)
     {
- 
         $client_id = null;
         $user = User::where('external_id', $request->user)->first();
 
         if ($request->client_external_id) {
             $client_id = Client::where('external_id', $request->client_external_id)->first()->id;
@@ -84,11 +87,11 @@ class AppointmentsController extends Controller
         return response($appointment);
     }
 
     public function destroy(Appointment $appointment)
     {
-        if (!auth()->user()->can("appointment-create")) {
+        if (!auth()->user()->can("appointment-delete")) {
             return response("Access denied", 403);
         }
 
         $deleted = $appointment->delete();
         if ($deleted) {
diff --git a/app/Http/Requests/User/StoreUserRequest.php b/app/Http/Requests/User/StoreUserRequest.php
index 5cb87614..cf0db58f 100644
--- a/app/Http/Requests/User/StoreUserRequest.php
+++ b/app/Http/Requests/User/StoreUserRequest.php
@@ -27,12 +27,12 @@ class StoreUserRequest extends FormRequest
             'name' => 'required',
             'email' => 'required|email',
             'address' => '',
             'primary_number' => 'numeric',
             'secondary_number' => 'numeric',
-            'password' => 'required|min:5|confirmed',
-            'password_confirmation' => 'required|min:5',
+            'password' => 'required|min:6|confirmed',
+            'password_confirmation' => 'required|min:6',
             'image_path' => '',
             'roles' => 'required',
             'departments' => 'required'
         ];
     }
diff --git a/app/Http/Requests/User/UpdateUserRequest.php b/app/Http/Requests/User/UpdateUserRequest.php
index 8af9e9ef..bb862d76 100644
--- a/app/Http/Requests/User/UpdateUserRequest.php
+++ b/app/Http/Requests/User/UpdateUserRequest.php
@@ -27,12 +27,12 @@ class UpdateUserRequest extends FormRequest
             'name' => 'required',
             'email' => 'required|email',
             'address' => '',
             'primary_number' => 'numeric',
             'secondary_number' => 'numeric',
-            'password' => 'sometimes',
-            'password_confirmation' => 'sometimes',
+            'password' => 'sometimes|min:6|confirmed',
+            'password_confirmation' => 'sometimes|min:6',
             'image_path' => '',
             'departments' => 'required'
         ];
     }
 }

Vulnerable code:  
        if (!auth()->user()->can("appointment-create")) {
            'password' => 'required|min:5|confirmed',
            'password_confirmation' => 'required|min:5',
            'password' => 'sometimes',
            'password_confirmation' => 'sometimes',
Fixed code:         if (!auth()->user()->can("calendar-view")) {
            session()->flash('flash_message_warning', __('You do not have permission to view this page'));
            return redirect()->back();
        }
        if (!auth()->user()->can("appointment-delete")) {
            'password' => 'required|min:6|confirmed',
            'password_confirmation' => 'required|min:6',
            'password' => 'sometimes|min:6|confirmed',
            'password_confirmation' => 'sometimes|min:6',