Ensembia/QRForge-selfhosted
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix IDOR: getQrcode/editQrcode/deleteQrcode had no ownership check

Browse Source 
Found while auditing the owner-scope SQL fix from the last commit:
getQrcode() queried purely by id with no scope applied at all (not even
the buggy old form), and editQrcode()/deleteQrcode() both call
getQrcode() first but then run their own unscoped where('id', $id) for
the actual update/delete. Net effect: any authenticated admin/user with
edit or delete rights could view, edit, or delete *any other tenant's*
qr code just by guessing/incrementing the id - in the static/dynamic
edit forms, the bulk download/delete endpoint, and the single delete
flow alike.

Fixed by applying qr_apply_owner_scope() in getQrcode() (covers the
edit-prefill and delete-lookup paths, and exits via failure() before
reaching the actual write query if out of scope) and adding it directly
to the update/delete queries in editQrcode()/deleteQrcode() too, for
defense in depth rather than relying solely on the earlier check.
Verified with a two-tenant scenario (separate admin accounts): before
the fix admin B could view/edit-prefill/delete admin A's qr code, after
the fix all three are correctly blocked (404 / "not found" / delete is
silently a no-op) and admin A's code is untouched.

Users.php and presets.php were checked too and already scope correctly
via different, unaffected patterns - this was isolated to the two
Qrcode classes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fo3DiRRpmz2DXjD7Uzhc8u
This commit is contained in:
Dillard Blom
2026-07-11 11:40:06 +02:00
parent 4490ee77d6
commit b9a737419c
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/Qrcode/Qrcode-intchil.php
+5
View File
@@ -207,9 +207,12 @@ class Qrcode {
}
public function getQrcode($id) {
require_once BASE_PATH . '/includes/security.php';
$db = getDbInstance();
$db->where('id', $id);
qr_apply_owner_scope($db);
$result = $db->getOne($this->table);
if($result !== NULL)
@@ -531,6 +534,7 @@ class Qrcode {
if(!file_exists(SAVED_QRCODE_DIRECTORY.$data_to_db['filename'].'.'.$old_qrcode["format"]) || $data_to_db['filename'] == $input_data["old_filename"]){
$db->where('id', $input_data["id"]);
qr_apply_owner_scope($db);
$stat = $db->update($this->table, $data_to_db);
try{
@@ -563,6 +567,7 @@ class Qrcode {
$qrcode = $this->getQrcode($id);
$db->where('id', $id);
qr_apply_owner_scope($db);
$status = $db->delete($this->table);
if ($status) {
src/lib/Qrcode/Qrcode.php
+5
View File
@@ -192,9 +192,12 @@ class Qrcode {
}
public function getQrcode($id) {
require_once BASE_PATH . '/includes/security.php';
$db = getDbInstance();
$db->where('id', $id);
qr_apply_owner_scope($db);
$result = $db->getOne($this->table);
if($result !== NULL)
@@ -376,6 +379,7 @@ class Qrcode {
if(!file_exists(SAVED_QRCODE_DIRECTORY.$data_to_db['filename'].'.'.$old_qrcode["format"]) || $data_to_db['filename'] == $input_data["old_filename"]){
$db->where('id', $input_data["id"]);
qr_apply_owner_scope($db);
$stat = $db->update($this->table, $data_to_db);
try{
@@ -408,6 +412,7 @@ class Qrcode {
$qrcode = $this->getQrcode($id);
$db->where('id', $id);
qr_apply_owner_scope($db);
$status = $db->delete($this->table);
if ($status) {