Security: No role enforcement, unauthenticated book management, missing CSRF

[lighthousekeeper1212]

Summary

The application has no role-based access control. Authentication is conflated with authorization — any logged-in user has full librarian access, and several endpoints are completely unauthenticated.

Findings

1. No role enforcement — any user is an admin (CRITICAL)

filters.php — The auth filter only checks Auth::guest(), never verifying role. No is_admin or role column is used. The /create endpoint allows public account creation with no approval. Any self-registered user has full librarian access.

2. BooksController fully unauthenticated (CRITICAL)

routes.php line 68 — Route::resource('/books', 'BooksController') is outside all filter groups. POST /books allows unauthenticated book creation. GET /books/{id}/edit exposes student PII (name, roll number, branch, year) for any checked-out book, without authentication.

3. Missing CSRF on all authenticated endpoints (CRITICAL)

routes.php — The csrf filter is only applied to the guest group. All authenticated POST/PUT routes (book management, student approval, book issuance) have no CSRF protection.

4. Student details IDOR (HIGH)

StudentController@show — Student::find($id) with no ownership check. Any authenticated user enumerates all students and their borrowing history via sequential IDs.

5. Student approval IDOR (HIGH)

StudentController@update — Any authenticated user can approve/reject any student. No role check.

6. Book return via GET (HIGH)

LogController@edit — Destructive book return operation mapped to GET /issue-log/{id}/edit. Combined with missing CSRF, an <img> tag can silently trigger book returns.

7. Dead email verification (MEDIUM)

Account says "email sent to activate" but no email is sent and verification_status is never checked.

Recommended Fix

1. Add role column to users table and check in auth filter
2. Move BooksController resource inside auth group (or create separate public read-only routes)
3. Apply CSRF filter to all state-changing routes
4. Add ownership/role checks to student management