gitmedia/mivita
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

27-05-2026 DHL Modul v2.1 / Optimierung tracking

Browse source
This commit is contained in:
Kevin Adametz 2026-05-27 18:51:23 +02:00
parent 036595be94
commit 2bdc9ada3c
33 changed files with 2367 additions and 2086 deletions
Download patch file Download diff file Expand all files Collapse all files

18
app/Http/Controllers/ModalController.php
View file

@ -172,6 +172,7 @@ class ModalController extends Controller
}
if ($data['action'] === 'create-dhl-shipment') {
$this->authorizeDhlShipmentModal();
$id = $data['id'] ?? null;
$ret = $this->handleDhlShipmentModal($id, $data);
}
@ -202,6 +203,23 @@ class ModalController extends Controller
return null;
}
/**
* Ensure the current user is allowed to use the DHL shipment modal.
*
* The DHL cockpit is an admin-only tool. Without this guard a logged-in
* CRM user could call `POST /modal/load` with `action=create-dhl-shipment`
* and an arbitrary order id and would receive that order's recipient
* name, address, e-mail and existing shipments (IDOR).
*/
private function authorizeDhlShipmentModal(): void
{
$user = \Auth::user();
if (! $user || ! method_exists($user, 'isAdmin') || ! $user->isAdmin()) {
abort(403, 'DHL shipment modal is only available for admin users.');
}
}
/**
* Handle DHL shipment modal preparation
*