John Cardinal d75c3eecea case 4712 - customer contacts work only with their own service requests and units ...

Step 3 of 4712 (security review F14). The Customer role has change rights on
service requests and nothing checked whose they were. For customer contacts:
another customer's request is not found (read, update, delete); creating or
moving a request to a customer the contact does not own is refused (403); a
contact's request is always requested by that contact. unit/customerunit adds
units only to the contact's own customer (or one of its head office's).

Checked: another customer's request 404 (was 200), create for another customer
403, own request created and deleted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-24 14:02:19 -07:00

..

ApiRootController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

AttachmentController.cs

case 4712 - customer contacts reach only their own customer's work orders

2026-10-24 13:52:31 -07:00

AuthController.cs

case 4710 - 2FA step requires the temp token from the password step

2026-10-24 11:28:17 -07:00

AuthorizationRolesController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

BackupController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ContractController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

CustomerController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

CustomerNoteController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

CustomerNotifySubscriptionController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

CustomerServiceRequestController.cs

case 4712 - customer contacts work only with their own service requests and units

2026-10-24 14:02:19 -07:00

DashboardViewController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

DataListColumnViewController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

DataListController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

DataListSavedFilterController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

EnumListController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

EventLogController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ExportController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

FormCustomController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

FormFieldsDefinitionsController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

FormUserOptionsController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

GlobalBizSettingsController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

GlobalOpsBackupSettingsController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

GlobalOpsNotificationSettingsController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

HeadOfficeController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

HealthController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ImportController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

IntegrationController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

JobOperationsController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

KPIController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

LicenseController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

LoanUnitController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

LogFilesController.cs

case 4715 - download file names checked

2026-10-24 12:20:25 -07:00

LogoController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

MemoController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

NameController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

NotifyController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

NotifySubscriptionController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

PartAssemblyController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

PartController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

PartInventoryController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

PartWarehouseController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

PickListController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

PMController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ProjectController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

PurchaseOrderController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

QuoteController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

QuoteStatusController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ReminderController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ReportController.cs

case 4718 - report and translation import need create rights

2026-10-24 12:10:00 -07:00

ReviewController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ScheduleController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

SearchController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ServerMetricsController.cs

case 4690 - remove MiniProfiler (never used): packages, wiring, profiler auth workaround, credits entry

2026-10-22 18:49:28 -07:00

ServerStateController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ServiceBankController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ServiceRateController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

TagController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

TaskGroupController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

TaxCodeController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

TranslationController.cs

case 4718 - report and translation import need create rights

2026-10-24 12:10:00 -07:00

TravelRateController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

TrialController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

UnitController.cs

case 4712 - customer contacts work only with their own service requests and units

2026-10-24 14:02:19 -07:00

UnitModelController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

UserController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

UserOptionsController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

VendorController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

WorkOrderController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

WorkOrderItemPriorityController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

WorkOrderItemStatusController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

WorkOrderStatusController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00