AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-11-11 07:01:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Security: scope set_recurring_payment to the client's own invoice and payment method

Browse Source
This commit is contained in:
johnnyq
2026-10-08 16:02:21 -04:00
parent 2c8fb8753c
commit 5acb1802bb
2 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
agent/post/recurring_invoice.php
View File

@@ -567,10 +567,16 @@ if (isset($_POST['set_recurring_payment'])) {
saved_payment_description FROM payment_providers
LEFT JOIN client_saved_payment_methods ON saved_payment_provider_id = payment_provider_id
WHERE saved_payment_id = $saved_payment_id
AND saved_payment_client_id = $client_id
");
$row = mysqli_fetch_assoc($sql);
if (!$row) {
flashAlert("Payment method not found for this client.", 'error');
redirect();
}
$provider_id = intval($row['payment_provider_id']);
$provider_name = escapeSql($row['payment_provider_name']);
$account_id = intval($row['payment_provider_account']);

15
client/post.php
View File

@@ -1358,13 +1358,21 @@ if (isset($_POST['set_recurring_payment'])) {
validateCSRFToken();
enforceContactCan('accounting');
$recurring_invoice_id = intval($_POST['recurring_invoice_id']);
$saved_payment_id = intval($_POST['saved_payment_id']);
// Get Recurring Invoice Info for logging and alerting
// Get Recurring Invoice Info - scoped to the logged-in client, so this is also the ownership check
$sql = mysqli_query($mysqli, "SELECT recurring_invoice_amount, recurring_invoice_currency_code, recurring_invoice_number,
recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id AND recurring_invoice_client_id = $session_client_id");
$row = mysqli_fetch_assoc($sql);
if (!$row) {
flashAlert("Recurring invoice not found.", 'danger');
redirect("recurring_invoices.php");
}
$recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']);
$recurring_invoice_currency_code = escapeSql($row['recurring_invoice_currency_code']);
@@ -1384,6 +1392,11 @@ if (isset($_POST['set_recurring_payment'])) {
$row = mysqli_fetch_assoc($sql);
if (!$row) {
flashAlert("Payment method not found or does not belong to you.", 'danger');
redirect("recurring_invoices.php");
}
$provider_id = intval($row['payment_provider_id']);
$provider_name = escapeSql($row['payment_provider_name']);
$account_id = intval($row['payment_provider_account']);