jekkos 3c7ece5c33 Fix permission bypass in Sales.getManage() access control (#4428) ...

The redirect() in getManage() returned a RedirectResponse that was never
executed, allowing unauthorized access to reports_sales. Updated method
signature to return ResponseInterface|string and properly return the
redirect response.

Refs: GHSA-94jm-c32g-48r5

Co-authored-by: Ollama <ollama@steganos.dev>

2026-03-13 17:52:07 +00:00

73 KiB

Raw Blame History

View Raw