mirror/snipe-it
3
0
Fork 0
mirror of https://github.com/snipe/snipe-it.git synced 2026-08-18 11:15:42 +00:00
Code Issues Projects Releases Wiki Activity

Barcode gate

Browse Source
This commit is contained in:
snipe
2026-08-07 16:59:01 +01:00
parent 55bdc7f5b3
commit ab103ce207
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
app/Http/Controllers/Assets/AssetsController.php
View File

@ -690,6 +690,14 @@ class AssetsController extends Controller
{
$settings = Setting::getSettings();
if ($asset = Asset::withTrashed()->find($assetId)) {
// Gate on the asset view policy so this endpoint enforces
// the same object-level authorization as its sibling detail
// / label / QR-code routes. Previously any authenticated
// user could pull the barcode PNG for any asset regardless
// of company scope, letting them enumerate protected asset
// tags.
$this->authorize('view', $asset);
$barcode_file = public_path().'/uploads/barcodes/'.str_slug($settings->label2_1d_type).'-'.str_slug($asset->asset_tag).'.png';
if (isset($asset->id, $asset->asset_tag)) {