Fix security in WellController

2021-10-20 17:55:50 +05:00 · 2021-10-20 17:55:50 +05:00 · 8b54966876
commit 8b54966876
parent 167dd3d5f5
1 changed files with 1 additions and 1 deletions
--- a/AsbCloudWebApi/Controllers/WellController.cs
+++ b/AsbCloudWebApi/Controllers/WellController.cs
@ -58,7 +58,7 @@ namespace AsbCloudWebApi.Controllers
        {
            var idCompany = User.GetCompanyId();

-            if (idCompany is null)
+            if (idCompany is null || !await wellService.IsCompanyInvolvedInWellAsync(idCompany??default, idWell, token).ConfigureAwait(false))
                return NoContent();

            var well = await wellService.GetAsync(idWell,