admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4712 - customer contacts' pick lists limited to their own records

Browse Source 
Step 4 of 4712 (security review F15). Pick lists checked only the Select role,
which customer contacts have for most types, and took the columns from the
request, so a contact could list every customer with phones and emails. For
contacts now: the customer list holds only their own customer (head office
contacts: their head office's customers); the unit list only their own
customer's units (head office contacts: the chosen customer, which must be
theirs; none until one is chosen); unit models as before; any other list 403.
pick-list/single names only those records. New CustomerPickList variant for a
single customer. Staff unchanged.

Checked: the contact's customer list went from 72 customers to its own one;
units only its own; vendors and users 403.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-24 14:14:43 -07:00
parent 692fececc7
commit 443d382394
4 changed files with 78 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
server/AyaNova/PickList/CustomerPickList.cs
View File

@@ -121,7 +121,7 @@ namespace AyaNova.PickList
int nType = 0;
if (!int.TryParse(crit[1], out nType)) return string.Empty;
AyaType forType = (AyaType)nType;
if (forType != AyaType.HeadOffice) return string.Empty;
if (forType != AyaType.HeadOffice && forType != AyaType.Customer) return string.Empty;
long lId = 0;
if (!long.TryParse(crit[0], out lId)) return string.Empty;
@@ -134,6 +134,10 @@ namespace AyaNova.PickList
{
return $"acustomer.headofficeid = {lId}";
}
case AyaType.Customer://case 4712: one customer only (a customer contact's own)
{
return $"acustomer.id = {lId}";
}
}
}
return string.Empty;