CVE-2022-22107: Missing Authorization (CWE-862)
value: In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 4.3
Published: 2022-01-05T15:15Z
Repository: https://github.com/Bottelet/DaybydayCRM
Language: PHP
Files changed: app/Http/Controllers/AppointmentsController.php, app/Http/Requests/User/StoreUserRequest.php, app/Http/Requests/User/UpdateUserRequest.php
Commit date: 2021-06-25 21:31:54 +0200
Commit message: password change requires 6 on update, and only allowed users can see calendar

Diff: diff --git a/app/Http/Controllers/AppointmentsController.php b/app/Http/Controllers/AppointmentsController.php
index 619fc8c..b15a100 100644
--- a/app/Http/Controllers/AppointmentsController.php
+++ b/app/Http/Controllers/AppointmentsController.php
@@ -13,10 +13,14 @@ use Ramsey\Uuid\Uuid;
 
 class AppointmentsController extends Controller
 {
     public function calendar()
     {
+        if (!auth()->user()->can("calendar-view")) {
+            session()->flash('flash_message_warning', __('You do not have permission to view this page'));
+            return redirect()->back();
+        }
         return view('appointments.calendar');
     }
 
     public function appointmentsJson()
     {
@@ -36,11 +40,10 @@ class AppointmentsController extends Controller
         return response($appointment);
     }
 
     public function store(CreateAppointmentCalendarRequest $request)
     {
- 
         $client_id = null;
         $user = User::where('external_id', $request->user)->first();
 
         if ($request->client_external_id) {
             $client_id = Client::where('external_id', $request->client_external_id)->first()->id;
@@ -84,11 +87,11 @@ class AppointmentsController extends Controller
         return response($appointment);
     }
 
     public function destroy(Appointment $appointment)
     {
-        if (!auth()->user()->can("appointment-create")) {
+        if (!auth()->user()->can("appointment-delete")) {
             return response("Access denied", 403);
         }
 
         $deleted = $appointment->delete();
         if ($deleted) {
diff --git a/app/Http/Requests/User/StoreUserRequest.php b/app/Http/Requests/User/StoreUserRequest.php
index 5cb8761..cf0db58 100644
--- a/app/Http/Requests/User/StoreUserRequest.php
+++ b/app/Http/Requests/User/StoreUserRequest.php
@@ -27,12 +27,12 @@ class StoreUserRequest extends FormRequest
             'name' => 'required',
             'email' => 'required|email',
             'address' => '',
             'primary_number' => 'numeric',
             'secondary_number' => 'numeric',
-            'password' => 'required|min:5|confirmed',
-            'password_confirmation' => 'required|min:5',
+            'password' => 'required|min:6|confirmed',
+            'password_confirmation' => 'required|min:6',
             'image_path' => '',
             'roles' => 'required',
             'departments' => 'required'
         ];
     }
diff --git a/app/Http/Requests/User/UpdateUserRequest.php b/app/Http/Requests/User/UpdateUserRequest.php
index 8af9e9e..bb862d7 100644
--- a/app/Http/Requests/User/UpdateUserRequest.php
+++ b/app/Http/Requests/User/UpdateUserRequest.php
@@ -27,12 +27,12 @@ class UpdateUserRequest extends FormRequest
             'name' => 'required',
             'email' => 'required|email',
             'address' => '',
             'primary_number' => 'numeric',
             'secondary_number' => 'numeric',
-            'password' => 'sometimes',
-            'password_confirmation' => 'sometimes',
+            'password' => 'sometimes|min:6|confirmed',
+            'password_confirmation' => 'sometimes|min:6',
             'image_path' => '',
             'departments' => 'required'
         ];
     }
 }

Vulnerable code:  
        if (!auth()->user()->can("appointment-create")) {
            'password' => 'required|min:5|confirmed',
            'password_confirmation' => 'required|min:5',
            'password' => 'sometimes',
            'password_confirmation' => 'sometimes',
Fixed code:         if (!auth()->user()->can("calendar-view")) {
            session()->flash('flash_message_warning', __('You do not have permission to view this page'));
            return redirect()->back();
        }
        if (!auth()->user()->can("appointment-delete")) {
            'password' => 'required|min:6|confirmed',
            'password_confirmation' => 'required|min:6',
            'password' => 'sometimes|min:6|confirmed',
            'password_confirmation' => 'sometimes|min:6',