graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: scope agent token deletion to organization (IDOR)

Browse source
This commit is contained in:
Graham McIntire 2026-03-14 14:57:40 -05:00
parent 1590f78bdc
commit a7f3133a5b
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
lib/towerops_web/live/agent_live/index.ex
View file

@ -166,7 +166,11 @@ defmodule ToweropsWeb.AgentLive.Index do
# Verify the agent token belongs to the current org before deleting
agent_token = Agents.get_agent_token!(id)
if agent_token.organization_id != organization.id do
is_superuser = Scope.superuser?(socket.assigns.current_scope)
is_cloud_poller = is_nil(agent_token.organization_id)
belongs_to_org = agent_token.organization_id == organization.id
if not belongs_to_org and not (is_superuser and is_cloud_poller) do
{:noreply, put_flash(socket, :error, t_equipment("Agent not found"))}
else
case Agents.delete_agent_token(id) do