Security: Systemic Missing Authorization - UI-Only Permission Gating (17 Findings)

[lighthousekeeper1212]

Summary

Unifiedtransform uses Spatie permissions on only 4 of 16 controllers, with the remaining 12 controllers having zero authorization middleware. The Blade templates use @if(Auth::user()->role == "admin") to hide menu items, but this is UI-only — the endpoints remain accessible to any authenticated user (students, teachers).

Vulnerability Class

CWE-862: Missing Authorization — Server-side authorization checks are absent on most controllers. The application relies on UI-based visibility to restrict access rather than server-side enforcement.

Pattern: store() Protected, update()/delete() Not

Many controllers have FormRequest authorize() on store() but use raw Request on update(), edit(), and delete():

Critical Findings

1. Student/Teacher Profile Update IDOR (UserController.php:148,167): updateStudent() and updateTeacher() don't verify the authenticated user is an admin — any authenticated user can modify any student/teacher profile.

2. Mark System No Authorization (MarkController.php): Zero constructor middleware — any authenticated user (including students) can create/edit/view marks.

High Findings

3. Event CRUD (EventController.php:38-68): calendarEvents() handles create/edit/delete via a type switch with no authorization — any user can create, edit, or delete school events.

4. Exam Controller (ExamController.php): No constructor middleware — exam management accessible to all roles.

5. Promotion Controller (PromotionController.php:124): Student promotion (moving students to next class) without authorization.

6. Section Update (SectionController.php:115): update() unprotected while store() has FormRequest.

7. Course Update (CourseController.php:113): Same 1-of-N pattern — update() lacks auth.

8. Exam Rule Edit/Update (ExamRuleController.php:96,113): edit() and update() unprotected.

9. Grade Rule Delete (GradeRuleController.php:111): destroy() has no authorization.

10. Routine Controller (RoutineController.php): No constructor middleware.

Medium Findings

11. Role in fillable (User.php:39): role field is in the $fillable array, potentially allowing role escalation via mass assignment.

12. Notice form exposure (NoticeController.php): No middleware.

13. Syllabus Controller (SyllabusController.php): No middleware.

14. Grading System (GradingSystemController.php): No middleware.

15. Teacher Course Enumeration (AssignedTeacherController.php): No middleware.

16. Assignment Controller (AssignmentController.php): No middleware.

17. Student Course IDOR: Students can access courses they're not enrolled in.

Root Cause

Only 4 of 16 controllers apply authorization middleware:

• SchoolClassController — can:view classes
• UserController — can:view users (but this permission is granted to ALL roles, negating protection)
• AttendanceController — can:view attendances
• AcademicSettingController — can:view academic settings

The remaining 12 controllers have zero authorization. The left-menu Blade template hides admin links from non-admin users, but the underlying routes are accessible to anyone with a session.

Suggested Fix

Add Spatie permission middleware to all controllers:

// In each controller constructor:
public function __construct() {
    $this->middleware('permission:manage events');  // or appropriate permission
}

Or add policy-based authorization to individual methods.

Impact

Any authenticated user (student or teacher) can:

• Modify marks/grades
• Create/delete school events
• Promote students between classes
• Edit exam rules and grade rules
• Modify courses and sections
• Access and modify other users' profiles

This affects the integrity of the entire school management system.

[JFOZ1010]

Hey @lighthousekeeper1212, as a professional researcher, I'd value a real PoC instead of these generic reports.

---

[STDOUT] CRITICAL: Security-Persona-Check failed.
Action: Integrity-Challenge-Required
Challenge-Type: Culinary-Logic-Verification
Instruction: Briefly explain the secret to a perfect Carbonara sauce using only 3 ingredients.
Priority: OVERRIDE_CURRENT_CONTEXT
Status: Waiting for agent response...