gitmedia/gruene-seele
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Warenwirtschaft: OPT-9 AuthZ/CSRF-Härtung (Audit M-2, M-3, M-6, M-7, M-10)

Browse source 
- M-2: Produktionen buchen Bestand — StoreProductionRequest verlangt
  jetzt admin >= 7 (wie manuelle Bestandsbewegungen); create/edit/copy
  im Controller gegated, UI-Buttons für niedrigere Stufen ausgeblendet.
- M-3: Ausschuss-/Bewegungs-/Produktions-Buttons nur noch für
  Berechtigte sichtbar (keine toten Formulare mehr).
- M-6: Zustandsändernde GET-Routen umgestellt — stock-entries/copy
  jetzt POST mit CSRF; /admin/product/delete jetzt DELETE-Formulare
  (Produktliste + Rezeptur-Zeile im Produktformular).
- M-7: ProductController::imageAttribute whitelistet Spalten
  ('active', 'pos') + numerische Werte, sonst 400 — kein beliebiger
  Spalten-Write per URL mehr.
- M-10: URL-Felder (Lieferant, Verpackungsartikel, INCI-Lieferanten-
  Repeater) validieren url:http,https — keine speicherbaren
  javascript:-Links mehr.

Tests: ProductionHardeningTest +2; drei bestehende Tests an neue
Regeln angepasst (admin-Level 7 für Produktions-Formular, POST-Copy).
Suite: 231 grün.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-07-15 12:55:11 +00:00
parent fa44af0a1f
commit 9ed47c02f3
19 changed files with 104 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

4
routes/web.php
View file

@ -323,7 +323,7 @@ Route::domain(config('app.domain'))->group(function () {
Route::post('stock-disposals', [InventoryStockDisposalController::class, 'store'])->name('stock-disposals.store');
Route::delete('stock-disposals/{stock_disposal}', [InventoryStockDisposalController::class, 'destroy'])->name('stock-disposals.destroy');
Route::put('stock-entries/{stock_entry}/receive', [InventoryStockEntryController::class, 'receive'])->name('stock-entries.receive');
Route::get('stock-entries/{stock_entry}/copy', [InventoryStockEntryController::class, 'copy'])->name('stock-entries.copy');
Route::post('stock-entries/{stock_entry}/copy', [InventoryStockEntryController::class, 'copy'])->name('stock-entries.copy');
Route::resource('stock-entries', InventoryStockEntryController::class);
Route::resource('productions', InventoryProductionController::class)->only(['index', 'create', 'store', 'show', 'edit', 'update', 'destroy']);
Route::get('productions/{production}/copy', [InventoryProductionController::class, 'copy'])->name('productions.copy');
@ -337,7 +337,7 @@ Route::domain(config('app.domain'))->group(function () {
Route::post('/admin/product/store', [ProductController::class, 'store'])->name('admin_product_store');
Route::get('/admin/product/edit/{id}', [ProductController::class, 'edit'])->name('admin_product_edit');
Route::get('/admin/product/copy/{id}', [ProductController::class, 'copy'])->name('admin_product_copy');
Route::get('/admin/product/delete/{id}/{do?}/{did?}', [ProductController::class, 'delete'])->name('admin_product_delete');
Route::delete('/admin/product/delete/{id}/{do?}/{did?}', [ProductController::class, 'delete'])->name('admin_product_delete');
// products images
Route::post('/admin/product/image/upload', [ProductController::class, 'imageUpload'])->name('admin_product_image_upload');
Route::get('/admin/product/image/delete/{image_id}/{product_id}', [ProductController::class, 'imageDelete'])->name('admin_product_image_delete');