FOUR-13028 | The Editing of Any Process Can Be Accessed With Any User Who Has Projects Permissions Activated

[mcraeteisha]

Issue

Ticket: FOUR-13028

This pull request addresses an issue with Project Permissions that allowed unauthorized access and modification of processes, scripts, and screens.

Solution

Updated AuthServiceProvider's boot function. Queried the database for projects the user is a member or owner of and retrieved associated project assets. Adjusted $allowedEndpoints for Processes, Scripts, and Screens to limit user access to endpoints for assets associated with their projects.

How to Test

1. Go to branch observation/FOUR-13028 in processmaker.
2. Have Processes, Screens, and Scripts created in your environment.
3. Create a User with only Projects permissions.
4. Login with that User. Have a Project created with a Process, Screen, and Script.
5. Change the URL to access process editing: /modeler/{processId}.
6. Edit and Publish the process.
   • Users should only be able to access and edit processes that are associated with their projects.
   • If you visit the Modeler for a process associated with the user's project, you should be able to see and edit the process. If you visit the Modeler with a process that is not part of one of the user's projects, you should see a 'Not Authorized' page.
7. Repeat these steps with the Screen and Script editors.

ci:next

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.

[processmaker-sonarqube]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[eiresendez]

The fix correctly addresses the issue outlined in the ticket.
Added some optimizations to DB queries as they are operations executed on each application request.