From 38f23986aded31202a5de75cec8d5322381bd759 Mon Sep 17 00:00:00 2001
From: Leo Giovanetti <hello@leog.me>
Date: Mon, 23 May 2022 08:29:29 -0300
Subject: [PATCH] Hotfix: Fixing Security Issues (#2848)

* Fixing Privilege Escalation

* Fixing critical obj ref in availability

* Fixing reschedule security issue

Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
Co-authored-by: Peer Richelsen <peeroke@gmail.com>
---
 apps/web/pages/api/book/request-reschedule.ts   |  2 ++
 apps/web/server/routers/viewer/availability.tsx | 16 ++++++++++++++++
 apps/web/server/routers/viewer/teams.tsx        |  2 ++
 3 files changed, 20 insertions(+)

diff --git a/apps/web/pages/api/book/request-reschedule.ts b/apps/web/pages/api/book/request-reschedule.ts
index 9458d4a1f1..8160ad90ab 100644
--- a/apps/web/pages/api/book/request-reschedule.ts
+++ b/apps/web/pages/api/book/request-reschedule.ts
@@ -91,6 +91,8 @@ const handler = async (
       },
     });
 
+    if (bookingToReschedule.userId !== userOwner.id) throw new Error("UNAUTHORIZED");
+
     if (bookingToReschedule && userOwner) {
       let event: Partial<EventType> = {};
       if (bookingToReschedule.eventTypeId) {
diff --git a/apps/web/server/routers/viewer/availability.tsx b/apps/web/server/routers/viewer/availability.tsx
index ae16df97e9..be1a0bc668 100644
--- a/apps/web/server/routers/viewer/availability.tsx
+++ b/apps/web/server/routers/viewer/availability.tsx
@@ -143,6 +143,17 @@ export const availabilityRouter = createProtectedRouter()
     async resolve({ input, ctx }) {
       const { user, prisma } = ctx;
 
+      const scheduleToDelete = await prisma.schedule.findFirst({
+        where: {
+          id: input.scheduleId,
+        },
+        select: {
+          userId: true,
+        },
+      });
+
+      if (scheduleToDelete?.userId !== user.id) throw new TRPCError({ code: "UNAUTHORIZED" });
+
       if (user.defaultScheduleId === input.scheduleId) {
         // unset default
         await prisma.user.update({
@@ -197,8 +208,13 @@ export const availabilityRouter = createProtectedRouter()
         where: {
           id: input.scheduleId,
         },
+        select: {
+          userId: true,
+        },
       });
 
+      if (userSchedule?.userId !== user.id) throw new TRPCError({ code: "UNAUTHORIZED" });
+
       if (!userSchedule || userSchedule.userId !== user.id) {
         throw new TRPCError({
           code: "UNAUTHORIZED",
diff --git a/apps/web/server/routers/viewer/teams.tsx b/apps/web/server/routers/viewer/teams.tsx
index 7fe989808a..2d86431740 100644
--- a/apps/web/server/routers/viewer/teams.tsx
+++ b/apps/web/server/routers/viewer/teams.tsx
@@ -201,6 +201,8 @@ export const viewerTeamsRouter = createProtectedRouter()
     }),
     async resolve({ ctx, input }) {
       if (!(await isTeamAdmin(ctx.user?.id, input.teamId))) throw new TRPCError({ code: "UNAUTHORIZED" });
+      if (input.role === MembershipRole.OWNER && !(await isTeamOwner(ctx.user?.id, input.teamId)))
+        throw new TRPCError({ code: "UNAUTHORIZED" });
 
       const translation = await getTranslation(input.language ?? "en", "common");