Isaac ConnorandClaude Opus 4.8 aeb32ba7d9 fix: gate filterdebug modal on Filter::canView ...

The filterdebug modal (web/ajax/modals/filterdebug.php) builds and EXPLAINs a
filter's events query but enforced no authorization beyond the global login
check, so any authenticated user could inspect the MySQL EXPLAIN for an
arbitrary stored filter (including one they don't own).

Add ZM\Filter::canView() mirroring canDelete()/canEdit(): System viewers can
inspect any filter, otherwise the user must own it; an unsaved/transient
filter (no Id, built from the requester's own request in this modal) is
viewable by the requester. Construct the filter up front in filterdebug.php
and return early when the current user can't view it.

Add tests/php/test_filter_canview.php covering owner/non-owner/system/unsaved
cases.

refs GHSA-28mv-hqxw-qw84

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-28 21:45:08 -04:00

..

event_sort_test.php

feat: add Filter::buildSortSql for directional event sort specs with integration test

2026-06-09 17:35:39 -04:00

test_filter_canedit_autoexecute.php

fix: require System permission for filter AutoExecute and gate auto-actions in canEdit

2026-07-21 21:29:50 -04:00

test_filter_canview.php

fix: gate filterdebug modal on Filter::canView

2026-07-28 21:45:08 -04:00

test_filter_limit_sqli.php

fix: coerce Filter limit to int to prevent SQL injection

2026-07-28 21:27:47 -04:00

test_filter_term_date_range.php

perf: emit sargable range queries for Date/StartDate/EndDate filter terms

2026-05-29 22:13:22 -04:00