jesse-a/OpenCRM
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases 1 Packages Wiki Activity Actions

/data export-routes door VIEWER bereikbaar (privilege escalation) #86

New issue
Closed
opened 2026-05-26 18:23:24 +00:00 by jesse-a · 1 comment
jesse-a commented 2026-05-26 18:23:24 +00:00
Owner
Copy link

Severity: HIGH

/data/export (CSV-bulk-export van klanten, projecten, facturen, uren) en /data/ubl (UBL-XML + factuur-PDF-ZIP) checkten alleen if (!session). De UI-page op /data vereist ADMIN, maar de underlying routes deden dat niet. Een VIEWER kon dus via directe URL bij gevoelige bulk-data komen.

Fix: beide routes hasRole('ADMIN') + totpEnabled checks toegevoegd.

Files: src/app/(app)/data/export/route.ts, src/app/(app)/data/ubl/route.ts

**Severity: HIGH** `/data/export` (CSV-bulk-export van klanten, projecten, facturen, uren) en `/data/ubl` (UBL-XML + factuur-PDF-ZIP) checkten alleen `if (!session)`. De UI-page op `/data` vereist ADMIN, maar de underlying routes deden dat niet. Een VIEWER kon dus via directe URL bij gevoelige bulk-data komen. **Fix**: beide routes `hasRole('ADMIN')` + `totpEnabled` checks toegevoegd. **Files**: src/app/(app)/data/export/route.ts, src/app/(app)/data/ubl/route.ts
jesse-a commented 2026-05-26 18:23:25 +00:00
Author
Owner
Copy link

Opgelost in commit 67b2580.

Opgelost in commit 67b2580.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
v1.0.0
v0.11
v0.10
v0.9
v0.8
v0.7
v0.6
v0.5
Labels
Clear labels   
deferred
Known issue, deferred

  
fixed
Resolved

  
security
Security review finding

  
severity-high
High severity

  
severity-low
Low severity

  
severity-medium
Medium severity

No labels
deferred
fixed
security
severity-high
severity-low
severity-medium
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
jesse-a/OpenCRM#86
No description provided.