Summary
The Auth.php $resApiCalls whitelist (lines 30-33) that restricts admin-only API endpoints has two classes of issues that allow non-admin staff users to access admin-level operations.
1. Naming Mismatches (6 endpoints)
The whitelist uses singular names but the actual API endpoints in wpos.php use plural names, making the whitelist check ineffective:
| Whitelist entry (Auth.php) |
Actual endpoint (wpos.php) |
Line |
user/disable |
users/disable |
404 |
device/disable |
devices/disable |
422 |
location/add |
locations/add |
428 |
location/edit |
locations/edit |
432 |
location/delete |
locations/delete |
436 |
location/disable |
locations/disable |
440 |
isUserAllowed() at line 167 does array_search($apiAction, $this->resApiCalls) which won't match the plural form against the singular whitelist entry. If a non-admin user has these endpoints in their permissions array, the whitelist admin-only protection is bypassed.
2. Missing Whitelist Entries (~11 endpoints)
These admin-level operations are not in the whitelist:
settings/invoice/set (line 652) - while settings/pos/set and settings/general/set ARE whitelistedsettings/set (line 638) - generic settings modificationsettings/google/authinit + settings/google/authremove (lines 657, 660)- All 5
settings/xero/* endpoints (lines 663-675) - Xero accounting integration
message/send (line 738) - broadcast to all POS devicesdevice/reset (line 754) - reset POS devices
3. Duplicate Entry
settings/invoice/get appears twice in the whitelist (line 31).
Impact
Non-admin staff users who are granted these permissions can disable users, manage locations, modify invoice settings, configure third-party integrations, export sales to Xero, broadcast to all POS devices, and reset devices.
Suggested Fix
Fix the whitelist to use correct plural endpoint names and add all missing entries.
Discovery
Found via manual code review comparing whitelist entries against actual API endpoint case labels (1-of-N inconsistency pattern).
Summary
The
Auth.php$resApiCallswhitelist (lines 30-33) that restricts admin-only API endpoints has two classes of issues that allow non-admin staff users to access admin-level operations.1. Naming Mismatches (6 endpoints)
The whitelist uses singular names but the actual API endpoints in
wpos.phpuse plural names, making the whitelist check ineffective:user/disableusers/disabledevice/disabledevices/disablelocation/addlocations/addlocation/editlocations/editlocation/deletelocations/deletelocation/disablelocations/disableisUserAllowed()at line 167 doesarray_search($apiAction, $this->resApiCalls)which won't match the plural form against the singular whitelist entry. If a non-admin user has these endpoints in their permissions array, the whitelist admin-only protection is bypassed.2. Missing Whitelist Entries (~11 endpoints)
These admin-level operations are not in the whitelist:
settings/invoice/set(line 652) - whilesettings/pos/setandsettings/general/setARE whitelistedsettings/set(line 638) - generic settings modificationsettings/google/authinit+settings/google/authremove(lines 657, 660)settings/xero/*endpoints (lines 663-675) - Xero accounting integrationmessage/send(line 738) - broadcast to all POS devicesdevice/reset(line 754) - reset POS devices3. Duplicate Entry
settings/invoice/getappears twice in the whitelist (line 31).Impact
Non-admin staff users who are granted these permissions can disable users, manage locations, modify invoice settings, configure third-party integrations, export sales to Xero, broadcast to all POS devices, and reset devices.
Suggested Fix
Fix the whitelist to use correct plural endpoint names and add all missing entries.
Discovery
Found via manual code review comparing whitelist entries against actual API endpoint case labels (1-of-N inconsistency pattern).