Skip to content

Fix cross-store IDOR in store-panel customer product price/personalization #725

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KrzysztofPajak merged 2 commits into from
Jul 5, 2026
Merged

Fix cross-store IDOR in store-panel customer product price/personalization #725

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e8f4c77
Fix cross-store IDOR in store-panel customer product price/personaliz…
KrzysztofPajak Jul 5, 2026
7912153
Address review: restrict actions to POST, fix test ctor, avoid TOCTOU
KrzysztofPajak Jul 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/Tests/Grand.Web.Store.Tests/Controllers/CustomerControllerTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
using Grand.Business.Core.Interfaces.Common.Directory;
using Grand.Business.Core.Interfaces.Common.Localization;
using Grand.Business.Core.Interfaces.Customers;
using Grand.Business.Core.Interfaces.Marketing.Customers;
using Grand.Business.Core.Interfaces.Messages;
using Grand.Domain.Customers;
using Grand.Infrastructure;
Expand Down Expand Up @@ -59,6 +60,7 @@ private CustomerController BuildController(bool perStoreEnabled)
_customerServiceMock.Object,
_customerViewModelServiceMock.Object,
_customerManagerServiceMock.Object,
new Mock<ICustomerProductService>().Object,
new Mock<IProductReviewService>().Object,
new Mock<IProductReviewViewModelService>().Object,
new Mock<IProductViewModelService>().Object,
Expand Down
30 changes: 28 additions & 2 deletions src/Web/Grand.Web.Store/Controllers/CustomerController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
using Grand.Business.Core.Interfaces.Common.Directory;
using Grand.Business.Core.Interfaces.Common.Localization;
using Grand.Business.Core.Interfaces.Customers;
using Grand.Business.Core.Interfaces.Marketing.Customers;
using Grand.Business.Core.Interfaces.Messages;
using Grand.Business.Core.Utilities.Customers;
using Grand.Domain.Catalog;
Expand Down Expand Up @@ -45,6 +46,7 @@ public CustomerController(
ICustomerService customerService,
ICustomerViewModelService customerViewModelService,
ICustomerManagerService customerManagerService,
ICustomerProductService customerProductService,
IProductReviewService productReviewService,
IProductReviewViewModelService productReviewViewModelService,
IProductViewModelService productViewModelService,
Expand All @@ -62,6 +64,7 @@ public CustomerController(
_customerService = customerService;
_customerViewModelService = customerViewModelService;
_customerManagerService = customerManagerService;
_customerProductService = customerProductService;
_productReviewService = productReviewService;
_productReviewViewModelService = productReviewViewModelService;
_productViewModelService = productViewModelService;
Expand All @@ -84,6 +87,7 @@ public CustomerController(
private readonly ICustomerService _customerService;
private readonly ICustomerViewModelService _customerViewModelService;
private readonly ICustomerManagerService _customerManagerService;
private readonly ICustomerProductService _customerProductService;
private readonly IProductReviewService _productReviewService;
private readonly IProductReviewViewModelService _productReviewViewModelService;
private readonly IProductViewModelService _productViewModelService;
Expand Down Expand Up @@ -827,30 +831,52 @@ public async Task<IActionResult> ProductAddPopup(string customerId, bool persona
}

[PermissionAuthorizeAction(PermissionActionName.Edit)]
[HttpPost]
public async Task<IActionResult> UpdateProductPrice(CustomerModel.ProductPriceModel model)
{
var productPrice = await _customerProductService.GetCustomerProductPriceById(model.Id);
Comment thread
Copilot marked this conversation as resolved.
if (productPrice == null || await GetStoreCustomer(productPrice.CustomerId) == null)
return new JsonResult("");

await _customerViewModelService.UpdateProductPrice(model);
return new JsonResult("");
}

[PermissionAuthorizeAction(PermissionActionName.Edit)]
[HttpPost]
public async Task<IActionResult> DeleteProductPrice(string id)
{
await _customerViewModelService.DeleteProductPrice(id);
var productPrice = await _customerProductService.GetCustomerProductPriceById(id);
Comment thread
Copilot marked this conversation as resolved.
if (productPrice == null || await GetStoreCustomer(productPrice.CustomerId) == null)
return new JsonResult("");

//delete the already-resolved entity to avoid a redundant reload / TOCTOU throw
await _customerProductService.DeleteCustomerProductPrice(productPrice);
return new JsonResult("");
}

[PermissionAuthorizeAction(PermissionActionName.Edit)]
[HttpPost]
public async Task<IActionResult> UpdatePersonalizedProduct(CustomerModel.ProductModel model)
{
var customerProduct = await _customerProductService.GetCustomerProduct(model.Id);
Comment thread
Copilot marked this conversation as resolved.
if (customerProduct == null || await GetStoreCustomer(customerProduct.CustomerId) == null)
return new JsonResult("");

await _customerViewModelService.UpdatePersonalizedProduct(model);
return new JsonResult("");
}

[PermissionAuthorizeAction(PermissionActionName.Edit)]
[HttpPost]
public async Task<IActionResult> DeletePersonalizedProduct(string id)
{
await _customerViewModelService.DeletePersonalizedProduct(id);
var customerProduct = await _customerProductService.GetCustomerProduct(id);
Comment thread
Copilot marked this conversation as resolved.
if (customerProduct == null || await GetStoreCustomer(customerProduct.CustomerId) == null)
return new JsonResult("");

//delete the already-resolved entity to avoid a redundant reload / TOCTOU throw
await _customerProductService.DeleteCustomerProduct(customerProduct);
return new JsonResult("");
}

Expand Down
Loading