fix(mgr): scope category product inline-edit PUT to the category (IDOR) (#454)

Inline-edit in the Category Products grid sent PUT /api/mgr/product-data/{id} with no category binding, so a manager could edit another category's product by id (IDOR, complements #443 which scoped the mutations).

- When category_id is in the body, the backend verifies msProduct.parent is in the same scope as the grid list filter (parent = categoryId, or nested descendants) via CategoryProductsListService::isProductInCategoryScope -> pure CategoryProductScopePolicy + CategoryTreeService (reused from #443). Out of scope -> 403. Fail-closed (missing product/service -> reject).
- category_id / nested are stripped before updateProductData(). Without category_id the product-card (ProductDataFields) path is unchanged, gated by the route permission.
- Vue inline-edit now always sends category_id + nested.
- Adds CategoryProductScopePolicyTest and the ms3_err_product_not_in_category_scope lexicon (en/ru).

Closes #444.

Author: Ibochkarev

core/components/minishop3/lexicon/en/default.inc.php

@@ -176,6 +176,7 @@
 $_lang['ms3_err_order_load'] = 'Error loading order.';
 $_lang['ms3_err_order_num_lock'] = 'Could not acquire a lock to generate the order number. Please try again.';
 $_lang['ms3_err_order_num_save'] = 'Could not save the order number. Please try again.';
+$_lang['ms3_err_product_not_in_category_scope'] = 'Product is not in the scope of this category.';
 $_lang['ms3_err_status_nf'] = 'Status with this identifier not found.';
 $_lang['ms3_err_delivery_nf'] = 'Delivery method with this identifier not found.';
 $_lang['ms3_err_payment_nf'] = 'Payment method with this identifier not found.';

core/components/minishop3/lexicon/ru/default.inc.php

@@ -176,6 +176,7 @@
 $_lang['ms3_err_order_load'] = 'Ошибка при загрузке заказа.';
 $_lang['ms3_err_order_num_lock'] = 'Не удалось получить блокировку для генерации номера заказа. Попробуйте ещё раз.';
 $_lang['ms3_err_order_num_save'] = 'Не удалось сохранить номер заказа. Попробуйте ещё раз.';
+$_lang['ms3_err_product_not_in_category_scope'] = 'Товар не входит в область этой категории.';
 $_lang['ms3_err_status_nf'] = 'Статус с таким идентификатором не найден.';
 $_lang['ms3_err_delivery_nf'] = 'Способ доставки с таким идентификатором не найден.';
 $_lang['ms3_err_payment_nf'] = 'Способ оплаты с таким идентификатором не найден.';

core/components/minishop3/src/Controllers/Api/ProductDataController.php

@@ -57,9 +57,35 @@ public function update(array $params): Response
             return Response::error('Product ID is required', HttpStatus::BAD_REQUEST);
         }
 
-        $data = $this->getRequestData();
+        $requestData = $this->getRequestData();
 
-        if (!$data) {
+        if (!$requestData) {
+            return Response::error('Invalid request data', HttpStatus::BAD_REQUEST);
+        }
+
+        $categoryId = (int) ($requestData['category_id'] ?? 0);
+        $nested = filter_var($requestData['nested'] ?? false, FILTER_VALIDATE_BOOLEAN);
+
+        $data = $requestData;
+        unset($data['category_id'], $data['nested']);
+
+        if ($categoryId > 0) {
+            /** @var \MiniShop3\Services\Category\CategoryProductsListService|null $listService */
+            $listService = $this->modx->services->get('ms3_category_products_list');
+            if (
+                !$listService
+                || !$listService->isProductInCategoryScope($productId, $categoryId, $nested)
+            ) {
+                $this->modx->lexicon->load('minishop3:default');
+
+                return Response::error(
+                    $this->modx->lexicon('ms3_err_product_not_in_category_scope'),
+                    HttpStatus::FORBIDDEN
+                );
+            }
+        }
+
+        if ($data === []) {
             return Response::error('Invalid request data', HttpStatus::BAD_REQUEST);
         }
 

core/components/minishop3/src/Services/Category/CategoryProductScopePolicy.php

@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+namespace MiniShop3\Services\Category;
+
+/**
+ * Pure scope rules for category products grid (same as CategoryProductsListService list filter).
+ */
+final class CategoryProductScopePolicy
+{
+    /**
+     * @param list<int> $descendantCategoryIds Child category IDs (recursive, excluding root)
+     */
+    public static function isParentInScope(
+        int $productParentId,
+        int $categoryId,
+        bool $nested,
+        array $descendantCategoryIds
+    ): bool {
+        if ($productParentId <= 0 || $categoryId <= 0) {
+            return false;
+        }
+
+        if (!$nested) {
+            return $productParentId === $categoryId;
+        }
+
+        $allowed = $descendantCategoryIds;
+        $allowed[] = $categoryId;
+
+        return in_array($productParentId, $allowed, true);
+    }
+}

core/components/minishop3/src/Services/Category/CategoryProductsListService.php

@@ -144,13 +144,7 @@ private function buildProductListQuery(int $categoryId, array $params, bool $nes
         }
 
         $c->where(['msProduct.class_key' => msProduct::class]);
-
-        if ($nested) {
-            $categoryIds = $this->treeService()->productParentIds($categoryId, true);
-            $c->where(['msProduct.parent:IN' => $categoryIds]);
-        } else {
-            $c->where(['msProduct.parent' => $categoryId]);
-        }
+        $c->where(['msProduct.parent:IN' => $this->getAllowedProductParentCategoryIds($categoryId, $nested)]);
 
         if ($query !== '') {
             $c->where([
@@ -225,6 +219,41 @@ private function quoteOptionKeyForJoinCondition(string $key): string
         return str_replace("'", "''", $key);
     }
 
+    /**
+     * Parent category IDs allowed for products in category grid scope (matches list filter).
+     *
+     * @return list<int>
+     */
+    public function getAllowedProductParentCategoryIds(int $categoryId, bool $nested): array
+    {
+        if (!$nested) {
+            return [$categoryId];
+        }
+
+        $ids = $this->treeService()->getDescendantCategoryIds($categoryId);
+        $ids[] = $categoryId;
+
+        return $ids;
+    }
+
+    /**
+     * Whether a product belongs to the category products grid scope (direct parent or nested tree).
+     */
+    public function isProductInCategoryScope(int $productId, int $categoryId, bool $nested): bool
+    {
+        $product = $this->modx->getObject(msProduct::class, $productId);
+        if (!$product) {
+            return false;
+        }
+
+        return CategoryProductScopePolicy::isParentInScope(
+            (int) $product->get('parent'),
+            $categoryId,
+            $nested,
+            $nested ? $this->treeService()->getDescendantCategoryIds($categoryId) : []
+        );
+    }
+
     /**
      * @param list<string> $optionFieldNames Allowed option field names (whitelist)
      *

core/components/minishop3/tests/CategoryProductScopePolicyTest.php

@@ -0,0 +1,47 @@
+<?php
+
+/**
+ * Regression tests for category product scope policy (issue #444).
+ *
+ * Run: php tests/CategoryProductScopePolicyTest.php
+ */
+
+declare(strict_types=1);
+
+require __DIR__ . '/../vendor/autoload.php';
+
+use MiniShop3\Services\Category\CategoryProductScopePolicy;
+
+$fail = static function (string $message): never {
+    fwrite(STDERR, "FAIL: {$message}\n");
+    exit(1);
+};
+
+$assertSame = static function ($expected, $actual, string $case) use ($fail): void {
+    if ($actual !== $expected) {
+        $fail($case . ': expected ' . var_export($expected, true) . ', got ' . var_export($actual, true));
+    }
+};
+
+$assertSame(true, CategoryProductScopePolicy::isParentInScope(10, 10, false, []), 'direct parent match');
+$assertSame(false, CategoryProductScopePolicy::isParentInScope(11, 10, false, []), 'direct parent mismatch');
+$assertSame(
+    true,
+    CategoryProductScopePolicy::isParentInScope(12, 10, true, [11, 12]),
+    'nested child category'
+);
+$assertSame(
+    true,
+    CategoryProductScopePolicy::isParentInScope(10, 10, true, [11, 12]),
+    'nested root category'
+);
+$assertSame(
+    false,
+    CategoryProductScopePolicy::isParentInScope(99, 10, true, [11, 12]),
+    'nested foreign parent'
+);
+$assertSame(false, CategoryProductScopePolicy::isParentInScope(0, 10, false, []), 'invalid product parent');
+$assertSame(false, CategoryProductScopePolicy::isParentInScope(10, 0, false, []), 'invalid category id');
+
+fwrite(STDOUT, "OK CategoryProductScopePolicyTest\n");
+exit(0);

vueManager/src/components/CategoryProductsGrid.vue

@@ -89,6 +89,8 @@ const {
 } = useCategoryProductsInlineEdit({
   products,
   referencePathsByKey,
+  categoryId: computed(() => props.categoryId),
+  nested,
   request,
   toast,
   _,

vueManager/src/composables/useCategoryProductsInlineEdit.js

@@ -17,12 +17,19 @@ import {
  * @param {Object} deps
  * @param {import('vue').Ref} deps.products
  * @param {import('vue').Ref<Record<string, string>>} deps.referencePathsByKey Paths from GET grid-config (editor_references)
+ * @param {import('vue').Ref<number>|number} deps.categoryId Category context for scoped inline edits
+ * @param {import('vue').Ref<boolean>|boolean} deps.nested Include nested subcategories in scope
  * @param {Function} deps.request HTTP client (e.g. project request)
  * @param {{ add: Function }} deps.toast PrimeVue toast
  * @param {Function} deps._ Lexicon helper
  */
 export function useCategoryProductsInlineEdit(deps) {
-  const { products, referencePathsByKey, request, toast, _ } = deps
+  const { products, referencePathsByKey, categoryId, nested, request, toast, _ } = deps
+
+  const resolveScopeContext = () => ({
+    category_id: typeof categoryId === 'object' && categoryId !== null ? categoryId.value : categoryId,
+    nested: Boolean(typeof nested === 'object' && nested !== null ? nested.value : nested),
+  })
 
   const editingCell = ref(null)
   const inlineEditValue = ref('')
@@ -204,7 +211,10 @@ export function useCategoryProductsInlineEdit(deps) {
     }
     inlineEditSaving.value = true
     try {
-      const res = await request.put(`/api/mgr/product-data/${product.id}`, { [column.name]: value })
+      const res = await request.put(`/api/mgr/product-data/${product.id}`, {
+        [column.name]: value,
+        ...resolveScopeContext(),
+      })
       const idx = products.value.findIndex(p => p.id === product.id)
       if (idx >= 0) {
         if (res && typeof res === 'object') {