fix: root + read:sensive could read senstive data with a middlewarew

2024-12-09 11:10:35 +01:00
parent ff74fb7385
commit 3fa7d03db7
10 changed files with 74 additions and 70 deletions
--- a/app/Http/Controllers/Api/SecurityController.php
+++ b/app/Http/Controllers/Api/SecurityController.php
@@ -11,13 +11,11 @@ class SecurityController extends Controller
 {
    private function removeSensitiveData($team)
    {
-        $token = auth()->user()->currentAccessToken();
-        if ($token->can('read:sensitive')) {
-            return serializeApiResponse($team);
+        if (request()->attributes->get('can_read_sensitive', false) === false) {
+            $team->makeHidden([
+                'private_key',
+            ]);
        }
-        $team->makeHidden([
-            'private_key',
-        ]);

        return serializeApiResponse($team);
    }