Raditya_Indra_Putranto/D1041231009-WebGIS-PovertyMap
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: prevent IDOR in transfer store — verify pengurus owns dari_ibadah

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
GuavaPopper
2026-06-05 04:59:01 +07:00
parent 652bcb102d
commit 64f3427d4e
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/TransferController.php
+9
View File
@@ -48,6 +48,15 @@ class TransferController extends Controller
'id_rumah' => 'required|string|exists:rumah_miskin,id_rumah', 'id_rumah' => 'required|string|exists:rumah_miskin,id_rumah',
'alasan' => 'required|string|max:1000', 'alasan' => 'required|string|max:1000',
]); ]);
// Pengurus hanya boleh mengajukan dari ibadah yang mereka kelola
$user = auth()->user();
if (!$user->hasRole('administrator')) {
$ownedIds = RumahIbadah::where('user_id', $user->id)->pluck('id');
if (!$ownedIds->contains((int) $validated['dari_ibadah_id'])) {
return response()->json(['message' => 'Tidak berhak mengajukan transfer dari ibadah ini'], 403);
}
}
$permohonan = PermohonanTransfer::create([ $permohonan = PermohonanTransfer::create([
...$validated, ...$validated,
'diajukan_oleh' => auth()->id(), 'diajukan_oleh' => auth()->id(),