Hotfix/issue#315 security bulk operations

Config/vaahcms.php

@@ -8,7 +8,7 @@
 $settings =  [
     'app_name' => 'VaahCMS',
     'app_slug' => 'vaahcms',
-    'version' => '2.3.5',
+    'version' => '2.3.6',
     'php_version_required' => '8.1',
     'get_config_version' => false,
     'website' => 'https://vaah.dev/cms',

Database/Seeders/json/permissions.json

@@ -378,6 +378,12 @@
         "section": "batches",
         "details": "This will allow user to delete batches."
     },
+    {
+        "name": "Can Update Batch",
+        "module": "vaahcms",
+        "section": "batches",
+        "details": "This will allow user to update batch."
+    },
     {
         "name": "Can Read Batch Details",
         "module": "vaahcms",
@@ -408,6 +414,12 @@
         "section": "failedjobs",
         "details": "This will allow user to view failed jobs exception."
     },
+    {
+        "name": "Can Update Failed Jobs",
+        "module": "vaahcms",
+        "section": "failedjobs",
+        "details": "This will allow user to update failed jobs."
+    },
     {
         "name": "Has Access Of Jobs Section",
         "module": "vaahcms",
@@ -426,6 +438,12 @@
         "section": "jobs",
         "details": "This will allow user to delete jobs."
     },
+    {
+        "name": "Can Update Jobs",
+        "module": "vaahcms",
+        "section": "jobs",
+        "details": "This will allow user to update jobs."
+    },
     {
         "name": "Has Access Of Taxonomies Section",
         "module": "vaahcms",

Http/Controllers/Backend/Advanced/BatchesController.php

@@ -101,6 +101,13 @@ public function getList(Request $request): JsonResponse
     //----------------------------------------------------------
     public function listAction(Request $request, $type): JsonResponse
     {
+        $permission_slugs = ['can-delete-batch','can-update-batch'];
+        $permission_response = Auth::user()->hasPermissions($permission_slugs);
+
+        if(isset($permission_response['success']) && $permission_response['success'] == false) {
+            return response()->json($permission_response);
+        }
+
         try {
             $response = Batch::listAction($request, $type);
         } catch (\Exception $e) {
@@ -120,6 +127,12 @@ public function listAction(Request $request, $type): JsonResponse
     //----------------------------------------------------------
     public function deleteList(Request $request): JsonResponse
     {
+        $permission_slugs = ['can-delete-batch','can-update-batch'];
+        $permission_response = Auth::user()->hasPermissions($permission_slugs);
+
+        if(isset($permission_response['success']) && $permission_response['success'] == false) {
+            return response()->json($permission_response);
+        }
         try {
             $response = Batch::deleteList($request);
         } catch (\Exception $e) {
@@ -139,6 +152,13 @@ public function deleteList(Request $request): JsonResponse
     //----------------------------------------------------------
     public function deleteItem(Request $request, $id): JsonResponse
     {
+
+        $permission_slugs = ['can-delete-batch','can-update-batch'];
+        $permission_response = Auth::user()->hasPermissions($permission_slugs);
+
+        if(isset($permission_response['success']) && $permission_response['success'] == false) {
+            return response()->json($permission_response);
+        }
         try {
             $request->merge(['inputs' => [$id]]);
             $response = Batch::bulkDelete($request);
@@ -159,6 +179,11 @@ public function deleteItem(Request $request, $id): JsonResponse
     //----------------------------------------------------------
     public function itemAction(Request $request, $id, $action): JsonResponse
     {
+        $permission_slug = 'can-update-batch';
+
+        if(!Auth::user()->hasPermission($permission_slug)) {
+            return vh_get_permission_denied_json_response($permission_slug);
+        }
         try {
             $response = Batch::itemAction($request, $id, $action);
         } catch (\Exception $e) {

Http/Controllers/Backend/Advanced/FailedJobsController.php

@@ -96,6 +96,11 @@ public function getList(Request $request): JsonResponse
     //----------------------------------------------------------
     public function updateList(Request $request): JsonResponse
     {
+        $permission_slug = 'can-update-failed-jobs';
+
+        if(!Auth::user()->hasPermission($permission_slug)) {
+            return vh_get_permission_denied_json_response($permission_slug);
+        }
         try {
             $response = FailedJob::updateList($request);
         } catch (\Exception $e) {
@@ -115,6 +120,13 @@ public function updateList(Request $request): JsonResponse
     //----------------------------------------------------------
     public function listAction(Request $request, $type): JsonResponse
     {
+
+        $permission_slugs = ['can-delete-failed-jobs','can-update-failed-jobs'];
+        $permission_response = Auth::user()->hasPermissions($permission_slugs);
+
+        if(isset($permission_response['success']) && $permission_response['success'] == false) {
+            return response()->json($permission_response);
+        }
         try {
             $response = FailedJob::listAction($request, $type);
         } catch (\Exception $e) {
@@ -134,6 +146,13 @@ public function listAction(Request $request, $type): JsonResponse
     //----------------------------------------------------------
     public function deleteList(Request $request): JsonResponse
     {
+        $permission_slugs = ['can-delete-failed-jobs','can-update-failed-jobs'];
+        $permission_response = Auth::user()->hasPermissions($permission_slugs);
+
+        if(isset($permission_response['success']) && $permission_response['success'] == false) {
+            return response()->json($permission_response);
+        }
+
         try {
             $response = FailedJob::deleteList($request);
         } catch (\Exception $e) {
@@ -153,6 +172,12 @@ public function deleteList(Request $request): JsonResponse
     //----------------------------------------------------------
     public function deleteItem(Request $request, $id): JsonResponse
     {
+        $permission_slugs = ['can-delete-failed-jobs','can-update-failed-jobs'];
+        $permission_response = Auth::user()->hasPermissions($permission_slugs);
+
+        if(isset($permission_response['success']) && $permission_response['success'] == false) {
+            return response()->json($permission_response);
+        }
         try {
             $response = FailedJob::deleteItem($request, $id);
         } catch (\Exception $e) {

Http/Controllers/Backend/Advanced/JobsController.php

@@ -102,6 +102,13 @@ public function getList(Request $request): JsonResponse
 
     public function listAction(Request $request, $type): JsonResponse
     {
+
+        $permission_slugs = ['can-delete-jobs','can-update-jobs'];
+        $permission_response = Auth::user()->hasPermissions($permission_slugs);
+
+        if(isset($permission_response['success']) && $permission_response['success'] == false) {
+            return response()->json($permission_response);
+        }
         try {
             $response = Job::listAction($request, $type);
         } catch (\Exception $e) {
@@ -121,6 +128,13 @@ public function listAction(Request $request, $type): JsonResponse
     //----------------------------------------------------------
     public function deleteList(Request $request): JsonResponse
     {
+
+        $permission_slugs = ['can-delete-jobs','can-update-jobs'];
+        $permission_response = Auth::user()->hasPermissions($permission_slugs);
+
+        if(isset($permission_response['success']) && $permission_response['success'] == false) {
+            return response()->json($permission_response);
+        }
         try {
             $response = Job::deleteList($request);
         } catch (\Exception $e) {
@@ -140,6 +154,12 @@ public function deleteList(Request $request): JsonResponse
     //----------------------------------------------------------
     public function deleteItem(Request $request, $id): JsonResponse
     {
+        $permission_slugs = ['can-delete-jobs','can-update-jobs'];
+        $permission_response = Auth::user()->hasPermissions($permission_slugs);
+
+        if(isset($permission_response['success']) && $permission_response['success'] == false) {
+            return response()->json($permission_response);
+        }
         try {
             $response = Job::deleteItem($request,$id);
         } catch (\Exception $e) {
@@ -159,6 +179,11 @@ public function deleteItem(Request $request, $id): JsonResponse
     //----------------------------------------------------------
     public function itemAction(Request $request, $id, $action): JsonResponse
     {
+        $permission_slug = 'can-update-jobs';
+
+        if(!Auth::user()->hasPermission($permission_slug)) {
+            return vh_get_permission_denied_json_response($permission_slug);
+        }
         try {
             $response = Job::itemAction($request, $id, $action);
         } catch (\Exception $e) {

Http/Controllers/Backend/MediaController.php

@@ -301,6 +301,12 @@ public function itemAction(Request $request, $id, $action): JsonResponse
     //----------------------------------------------------------
     public function itemDownload(Request $request, $slug): BinaryFileResponse | JsonResponse
     {
+        $permission_slug = 'can-manage-media';
+
+        if(!Auth::user()->hasPermission($permission_slug)) {
+            return vh_get_permission_denied_json_response($permission_slug);
+        }
+
         try {
             $media_data = Media::where('download_url', $slug)->first();
         } catch (\Exception $e) {

Http/Controllers/Backend/UsersController.php

@@ -156,10 +156,11 @@ public function updateList(Request $request): JsonResponse
     //----------------------------------------------------------
     public function listAction(Request $request, $type): JsonResponse
     {
-        $permission_slug = 'can-update-users';
+        $permission_slugs = ['can-update-users','can-delete-users'];
+        $permission_response = Auth::user()->hasPermissions($permission_slugs);
 
-        if(!Auth::user()->hasPermission($permission_slug)) {
-            return vh_get_permission_denied_json_response($permission_slug);
+        if(isset($permission_response['success']) && $permission_response['success'] == false) {
+            return response()->json($permission_response);
         }
 
         try {
@@ -181,6 +182,11 @@ public function listAction(Request $request, $type): JsonResponse
     //----------------------------------------------------------
     public function deleteList(Request $request): JsonResponse
     {
+        $permission_slug = 'can-delete-users';
+
+        if(!Auth::user()->hasPermission($permission_slug)) {
+            return vh_get_permission_denied_json_response($permission_slug);
+        }
         try {
             $response = User::deleteList($request);
         } catch (\Exception $e) {