-
-
Notifications
You must be signed in to change notification settings - Fork 3.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Updated Company::getIdForCurrentUser()
to return null in certain scenarios
#15691
base: develop
Are you sure you want to change the base?
Updated Company::getIdForCurrentUser()
to return null in certain scenarios
#15691
Conversation
…not super admin, and does not have company
PR Summary
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this is wrong and reintroduces the bug that with FullMultipleCompanySupport a normal user can create assets with arbitrary company_id.
is_int checks the type of the variable. But the default behaviour of postman seems to be that the values are strings. I tested this further with a simple python requests and can confirm that when I create the payload values as integer the code works as expected. But when I create the payload values as strings, the code happily accepts every existing company_id.
So the correct behaviour should be to look at the value of the company_id, not the type. is_numeric seems to be the right function here.
Thanks for the review @Toreg87. I moved this back to draft to review and address your comments. |
Description
This PR fixes a bug in the
Company::getIdForCurrentUser()
method when full multiple company support was enabled, the acting user was not a super user and didn't have acompany_id
set the provided input was returned instead ofnull
like expected.This follows up the fix in #15660 by re-adding the code that was removed in the form request and handling it in the bug in the
Company::getIdForCurrentUser()
method mentioned above.This PR is mostly test code testing some, but not all, of the places the method is being used.
Type of change