Skip to content

Fix dashboard-only permission leaking global extract access#2

Open
AtlasLabs797 wants to merge 1 commit intomainfrom
codex/fix-dashboard-only-permission-vulnerability
Open

Fix dashboard-only permission leaking global extract access#2
AtlasLabs797 wants to merge 1 commit intomainfrom
codex/fix-dashboard-only-permission-vulnerability

Conversation

@AtlasLabs797
Copy link
Copy Markdown
Owner

Motivation

  • A global permission row with PuedeVerDashboard=true was being treated as full data access in ExtractosController, allowing non-admin users with dashboard-only permissions to read extractos across all cuentas and creating a cross-account data exposure that conflicts with UserAccessService semantics.

Description

  • Removed p.PuedeVerDashboard from the global-access condition in GetAllowedAccountIds and the identical check in CanViewTitular within Atlas Balance/backend/src/GestionCaja.API/Controllers/ExtractosController.cs so global access now requires one of PuedeAgregarLineas, PuedeEditarLineas, PuedeEliminarLineas or PuedeImportar.
  • Updated Documentacion/DOCUMENTACION_CAMBIOS.md and Documentacion/LOG_ERRORES_INCIDENCIAS.md to record the fix and associated it with version V-01.02.
  • Preserved existing admin behavior and explicit per-CuentaId/TitularId permission handling.

Testing

  • Performed static verification and diffs using sed -n, git diff and file inspection to confirm the condition was updated and documentation entries were added, and committed the change.
  • Could not run dotnet build or dotnet test in this environment because dotnet is not available (command not found), so running dotnet test "Atlas Balance/backend/GestionCaja.sln" -c Release in an environment with the .NET SDK is pending.

Codex Task

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant