From 64f3427d4efa03cb43cc054cad4205f1995f0c19 Mon Sep 17 00:00:00 2001 From: GuavaPopper Date: Fri, 5 Jun 2026 04:59:01 +0700 Subject: [PATCH] =?UTF-8?q?fix:=20prevent=20IDOR=20in=20transfer=20store?= =?UTF-8?q?=20=E2=80=94=20verify=20pengurus=20owns=20dari=5Fibadah?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Sonnet 4.6 --- app/Http/Controllers/TransferController.php | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/app/Http/Controllers/TransferController.php b/app/Http/Controllers/TransferController.php index 752d0ac..66f964f 100644 --- a/app/Http/Controllers/TransferController.php +++ b/app/Http/Controllers/TransferController.php @@ -48,6 +48,15 @@ class TransferController extends Controller 'id_rumah' => 'required|string|exists:rumah_miskin,id_rumah', 'alasan' => 'required|string|max:1000', ]); + // Pengurus hanya boleh mengajukan dari ibadah yang mereka kelola + $user = auth()->user(); + if (!$user->hasRole('administrator')) { + $ownedIds = RumahIbadah::where('user_id', $user->id)->pluck('id'); + if (!$ownedIds->contains((int) $validated['dari_ibadah_id'])) { + return response()->json(['message' => 'Tidak berhak mengajukan transfer dari ibadah ini'], 403); + } + } + $permohonan = PermohonanTransfer::create([ ...$validated, 'diajukan_oleh' => auth()->id(),