CVE-2022-0203 (published 2022-01-26T13:15Z)

Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/crater-invoice/crater
commit_details: repo_url: https://github.com/crater-invoice/crater
author: jayvirsinh_gohil
author_date: 2022-01-13 12:23:26+05:30
msg: solve payment method delete issue
repository: repo_url: https://github.com/crater-invoice/crater
repo_name: crater-invoice/crater
description: Open Source Invoicing Solution for Individuals & Businesses
repo_language: PHP
owner: crater-invoice
file_changes: filename: InvoicesController.php
change_type: ModificationType.MODIFY
diff: @@ -102,7 +102,7 @@ class InvoicesController extends Controller
     {
         $this->authorize('delete multiple invoices');
 
-        Invoice::destroy($request->ids);
+        Invoice::deleteInvoices($request->ids);
 
         return response()->json([
             'success' => true,

programming_language: PHP
filename: PaymentMethodsController.php
change_type: ModificationType.MODIFY
diff: @@ -84,12 +84,14 @@ class PaymentMethodsController extends Controller
     {
         $this->authorize('delete', $paymentMethod);
 
-        $payments = $paymentMethod->payments;
-
-        if ($payments->count() > 0) {
+        if ($paymentMethod->payments()->exists()) {
             return respondJson('payments_attached', 'Payments Attached.');
         }
 
+        if ($paymentMethod->expenses()->exists()) {
+            return respondJson('expenses_attached', 'Expenses Attached.');
+        }
+
         $paymentMethod->delete();
 
         return response()->json([

programming_language: PHP
filename: DownloadReceiptController.php
change_type: ModificationType.MODIFY
diff: @@ -17,6 +17,8 @@ class DownloadReceiptController extends Controller
      */
     public function __invoke(Expense $expense)
     {
+        $this->authorize('view', $expense);
+
         if ($expense) {
             $media = $expense->getFirstMedia('receipts');
             if ($media) {

programming_language: PHP
filename: Invoice.php
change_type: ModificationType.MODIFY
diff: @@ -698,4 +698,19 @@ class Invoice extends Model implements HasMedia
 
         $this->save();
     }
+
+    public static function deleteInvoices($ids)
+    {
+        foreach ($ids as $id) {
+            $invoice = self::find($id);
+
+            if ($invoice->transactions()->exists()) {
+                $invoice->transactions()->delete();
+            }
+
+            $invoice->delete();
+        }
+
+        return true;
+    }
 }

programming_language: PHP
filename: PaymentMethod.php
change_type: ModificationType.MODIFY
diff: @@ -31,6 +31,11 @@ class PaymentMethod extends Model
         return $this->hasMany(Payment::class);
     }
 
+    public function expenses()
+    {
+        return $this->hasMany(Expense::class);
+    }
+
     public function company()
     {
         return $this->belongsTo(Company::class);

programming_language: PHP