fix(security): enforce ownership on GET date-override (IDOR)

getOverride leaked any doctor's override to any authenticated user; add the owner-or-admin check (matching the update/delete endpoints) + regression test.
2026-06-28 16:48:41 +03:30
parent 90736c8149
commit 093293004a
2 changed files with 45 additions and 1 deletions
@@ -237,13 +237,17 @@ class AppointmentSettingsController extends BaseController
    }

    #[Route('/api/v1/appointment-settings/date-override/{uuid}', methods: ['GET'])]
-    public function getOverride(string $uuid): JsonResponse
+    public function getOverride(string $uuid, #[CurrentUser] User $user): JsonResponse
    {
        $override = $this->overrideRepo->findByUuid($uuid);
        if ($override === null) {
            return $this->error(ErrorCodes::ERR_VALIDATION_002, 'Override یافت نشد', 404);
        }

+        if ($override->getDoctor()->getUser()->getId() !== $user->getId() && !$user->hasRole('ROLE_ADMIN')) {
+            return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
+        }
+
        return $this->success(['data' => $override->toArray()]);
    }