Summary
Security audit identified 5 vulnerabilities (1 Critical, 2 High, 2 Medium) related to missing authorization controls.
Findings
1. Public Books Resource CRUD (CRITICAL)
File: routes.php:68
`Route::resource('/books', 'BooksController')` is defined OUTSIDE both the guest and auth route groups, making all 7 resource routes (index, create, store, show, edit, update, destroy) publicly accessible. While `store()` calls `Auth::id()` internally (line 70), this errors rather than properly blocking unauthenticated access. The `index()`, `show()`, and `edit()` methods return full book/issue data including student PII (name, roll number, branch, category).
Contrast: All other data routes (students, logs) are correctly inside the auth group (routes.php:71-126). This is a 1-of-N inconsistency.
2. No Role-Based Access Control (HIGH)
File: routes.php:71-126
The entire authenticated route group has no role differentiation. Students who self-register and get approved have identical access to librarians/admins. Any authenticated user can:
- Issue/return books for any student (LogController::store, edit)
- Add books to the catalog (BooksController::store)
- View/approve/reject student registrations (StudentController)
- Access all admin panel views
3. IDOR on Student Operations (HIGH)
File: app/controllers/StudentController.php
The student resource controller accepts student IDs from the request without verifying the authenticated user has authority over that student. Any authenticated user can approve, reject, or modify any student record.
4. Open Self-Registration (MEDIUM)
File: routes.php:34-37
Any anonymous user can register as a student. Once approved (and approval has no admin-only gate), they gain full authenticated access to all admin functions.
5. Student PII Exposure via Public Book Endpoint (MEDIUM)
File: app/controllers/BooksController.php:145-200
The `edit()` method returns student personal data (name, roll number, branch, year, category) for currently-issued books. Since the books resource is public, this PII is accessible without authentication.
Root Cause
Missing role-based middleware. The auth group should have an admin/librarian role check for data modification routes, and the books resource should be inside the auth group.
Found during security research.
Summary
Security audit identified 5 vulnerabilities (1 Critical, 2 High, 2 Medium) related to missing authorization controls.
Findings
1. Public Books Resource CRUD (CRITICAL)
File: routes.php:68
`Route::resource('/books', 'BooksController')` is defined OUTSIDE both the guest and auth route groups, making all 7 resource routes (index, create, store, show, edit, update, destroy) publicly accessible. While `store()` calls `Auth::id()` internally (line 70), this errors rather than properly blocking unauthenticated access. The `index()`, `show()`, and `edit()` methods return full book/issue data including student PII (name, roll number, branch, category).
Contrast: All other data routes (students, logs) are correctly inside the auth group (routes.php:71-126). This is a 1-of-N inconsistency.
2. No Role-Based Access Control (HIGH)
File: routes.php:71-126
The entire authenticated route group has no role differentiation. Students who self-register and get approved have identical access to librarians/admins. Any authenticated user can:
3. IDOR on Student Operations (HIGH)
File: app/controllers/StudentController.php
The student resource controller accepts student IDs from the request without verifying the authenticated user has authority over that student. Any authenticated user can approve, reject, or modify any student record.
4. Open Self-Registration (MEDIUM)
File: routes.php:34-37
Any anonymous user can register as a student. Once approved (and approval has no admin-only gate), they gain full authenticated access to all admin functions.
5. Student PII Exposure via Public Book Endpoint (MEDIUM)
File: app/controllers/BooksController.php:145-200
The `edit()` method returns student personal data (name, roll number, branch, year, category) for currently-issued books. Since the books resource is public, this PII is accessible without authentication.
Root Cause
Missing role-based middleware. The auth group should have an admin/librarian role check for data modification routes, and the books resource should be inside the auth group.
Found during security research.