Severity: HIGH
Location: lib/Controller/AanbodController.php lines 159–243 (acceptAanbod, denyAanbod); lib/Controller/AangebodenGebruikController.php lines 606–810 (setGebruikSelfToActiveOrg, deleteGebruikAsAfnemer)
Description:
Multiple state-mutating endpoints (acceptAanbod, denyAanbod, setGebruikSelfToActiveOrg, deleteGebruikAsAfnemer) are declared @PublicPage. The only runtime guard is an implicit getCurrentOrganisation() null-check, which returns null for anonymous callers, causing early return rather than a 401/403 response. This means anonymous requests are silently swallowed but the endpoints remain publicly addressable write surfaces with no authentication requirement enforced by the framework layer.
Suggested fix:
Drop @PublicPage from all state-changing routes; use @NoAdminRequired at most, so that the NC framework enforces at minimum a logged-in session before the controller method executes.
Source: deep team-reviewer pass 2026-05-27
Severity: HIGH
Location:
lib/Controller/AanbodController.phplines 159–243 (acceptAanbod,denyAanbod);lib/Controller/AangebodenGebruikController.phplines 606–810 (setGebruikSelfToActiveOrg,deleteGebruikAsAfnemer)Description:
Multiple state-mutating endpoints (
acceptAanbod,denyAanbod,setGebruikSelfToActiveOrg,deleteGebruikAsAfnemer) are declared@PublicPage. The only runtime guard is an implicitgetCurrentOrganisation()null-check, which returns null for anonymous callers, causing early return rather than a 401/403 response. This means anonymous requests are silently swallowed but the endpoints remain publicly addressable write surfaces with no authentication requirement enforced by the framework layer.Suggested fix:
Drop
@PublicPagefrom all state-changing routes; use@NoAdminRequiredat most, so that the NC framework enforces at minimum a logged-in session before the controller method executes.Source: deep team-reviewer pass 2026-05-27