hamed/clinicpro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): make commission_percent & active admin-only on PATCH representation

Browse Source 
A representation editing its own record could raise its own commission or
self-activate (privilege escalation). Restrict both fields to ROLE_ADMIN and
range-check commission (0–100). Owner can still edit name/city/bank.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
hamed
2026-06-28 17:36:48 +03:30
co-authored by Claude Opus 4.8
parent e456809b55
commit 6bd49c2d3e
3 changed files with 112 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Representation/Controller/RepresentationController.php
+32 -6
View File
@@ -107,6 +107,13 @@ class RepresentationController extends BaseController
return $this->error(ErrorCodes::ERR_CONFLICT_001, 'این کاربر قبلاً نماینده است', 409);
}
if (!empty($data['commission_percent'])) {
$commission = (float) $data['commission_percent'];
if ($commission < 0 || $commission > 100) {
return $this->error(ErrorCodes::ERR_VALIDATION_001, 'درصد کمیسیون باید بین ۰ تا ۱۰۰ باشد', 422, 'commission_percent');
}
}
$rep = new Representation($user, $fullName);
if (isset($data['city_id'])) $rep->setCityId($data['city_id'] ? (int)$data['city_id'] : null);
if (!empty($data['commission_percent'])) $rep->setCommissionPercent((string)$data['commission_percent']);
@@ -202,12 +209,31 @@ class RepresentationController extends BaseController
return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
}
$data = json_decode($request->getContent(), true) ?? [];
if (array_key_exists('full_name', $data)) $rep->setFullName($data['full_name']);
if (array_key_exists('city_id', $data)) $rep->setCityId($data['city_id'] ? (int)$data['city_id'] : null);
if (array_key_exists('bank_account', $data)) $rep->setBankAccount($data['bank_account']);
if (array_key_exists('commission_percent', $data)) $rep->setCommissionPercent((string)$data['commission_percent']);
if (array_key_exists('active', $data)) $rep->setActive((bool)$data['active']);
$data = json_decode($request->getContent(), true) ?? [];
$isAdmin = $user->hasRole('ROLE_ADMIN');
if (array_key_exists('full_name', $data)) $rep->setFullName($data['full_name']);
if (array_key_exists('city_id', $data)) $rep->setCityId($data['city_id'] ? (int)$data['city_id'] : null);
if (array_key_exists('bank_account', $data)) $rep->setBankAccount($data['bank_account']);
// commission_percent and active are privileged: a representative must not
// be able to raise their own commission or activate themselves.
if (array_key_exists('commission_percent', $data)) {
if (!$isAdmin) {
return $this->error(ErrorCodes::ERR_AUTH_006, 'تغییر درصد کمیسیون فقط توسط مدیر مجاز است', 403);
}
$commission = (float) $data['commission_percent'];
if ($commission < 0 || $commission > 100) {
return $this->error(ErrorCodes::ERR_VALIDATION_001, 'درصد کمیسیون باید بین ۰ تا ۱۰۰ باشد', 422, 'commission_percent');
}
$rep->setCommissionPercent((string) $commission);
}
if (array_key_exists('active', $data)) {
if (!$isAdmin) {
return $this->error(ErrorCodes::ERR_AUTH_006, 'تغییر وضعیت فعال‌بودن فقط توسط مدیر مجاز است', 403);
}
$rep->setActive((bool) $data['active']);
}
$this->representationRepo->save($rep);