AdminGit2026/nis2-agile
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2fd4b7ff26
nis2-agile/application/controllers
History
DevEnv nis2-agile 2fd4b7ff26 [FIX][SEC] Connettori: autorizzazione per-org + secret allowlist (findings review multi-agente) 
Due vulnerabilità trovate dalla review indipendente:
1. connectorOrgGuard usava users.role (GLOBALE) invece del ruolo per-org -> la feature
   era ROTTA per gli utenti reali (org_admin reale ha users.role='employee' -> 403 sulla
   propria org). Ora ancora l'autorizzazione al parametro di ROUTE {id} e legge
   user_organizations.role. Verificato E2E: globale=employee + per-org=org_admin -> 200;
   non-membro su altra org -> 403 (no IDOR via header X-Organization-Id).
2. secret-strip era una denylist case-sensitive/non-ricorsiva aggirabile (Client_Secret,
   apiKey, connection_string, segreti annidati). Sostituita con ALLOWLIST ricorsiva
   (sanitizeConnectorConfig): solo campi non sensibili noti, valori forzati a stringa+troncati.
   Verificato E2E: input con 11 varianti di segreti -> DB contiene solo {account_id, region}.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-05-30 11:37:25 +02:00
..
AdminController.php [CORE] Initial project scaffold - NIS2 Agile Compliance Platform 2026-02-17 17:50:18 +01:00
AiController.php [FEAT] AiController /api/ai/ask (ARIA) -> askWithRag + fix DNS Qdrant php-fpm 2026-05-29 18:55:44 +02:00
AssessmentController.php [CORE] Initial project scaffold - NIS2 Agile Compliance Platform 2026-02-17 17:50:18 +01:00
AssetController.php [FEAT] Asset import CMDB/cloud + scoring automatico GV.OC-04 (P2) 2026-05-30 09:14:12 +02:00
AuditController.php [FIX] Completamento UI: metodo controlsMonitoring, OpenAPI ingest endpoints, i18n format, help monitoraggio 2026-05-30 10:02:47 +02:00
AuthController.php [FEAT] Allineamento NIS2 ↔ TRPG (Fasi 1-5): SSO + Sessions + Reset + Impersonate + Branding 2026-05-29 13:18:35 +02:00
BaseController.php [FEAT] Allineamento NIS2 ↔ TRPG (Fasi 1-5): SSO + Sessions + Reset + Impersonate + Branding 2026-05-29 13:18:35 +02:00
BrandingController.php [FEAT] Allineamento NIS2 ↔ TRPG (Fasi 1-5): SSO + Sessions + Reset + Impersonate + Branding 2026-05-29 13:18:35 +02:00
ContactController.php [FIX] MktgLeadController + ContactController: getRequestBody → getJsonBody 2026-03-09 12:19:21 +01:00
CrossAnalysisController.php [FEAT] L4 AI Cross-Analysis — analisi aggregata multi-org per consulenti 2026-03-09 08:17:53 +01:00
DashboardController.php [FIX] P2/P3: aggiunti i metodi+route realmente mancanti (commit precedenti incompleti) 2026-05-30 10:36:39 +02:00
FeedbackController.php [FIX] FeedbackController/Service: u.name → u.full_name (colonna corretta) 2026-03-10 08:56:19 +01:00
IncidentController.php [FEAT] Integrazione analisi docs/nis2 v1.7.0 — scoring asset, tassonomia incidenti, PIR, NIST CSF, fonti certe 2026-05-29 17:15:13 +02:00
index.php [FEAT] Services API: full-snapshot endpoint + BigSim SSE wrapper 2026-03-17 15:16:00 +01:00
InviteController.php [FIX] InviteController requireRole→requireSuperAdmin + OnboardingController add RateLimitService 2026-03-10 15:54:16 +01:00
KnowledgeBaseController.php [FEAT] Knowledge Base RAG multi-livello (SYSTEM/FIRM/ORG) + Qdrant + Voyage 2026-05-29 15:44:13 +02:00
MktgLeadController.php [FEAT] MktgLead getJsonBody + script import-feedback-to-nexus + seed demo agile-tech 2026-05-29 15:42:05 +02:00
NonConformityController.php [FIX] ServicesController: query assessment_responses reale + NonConformityController: getPagination named keys 2026-03-09 10:22:40 +01:00
NormativeController.php [FIX] Database::execute() → Database::query() in 5 controller 2026-03-07 16:49:58 +01:00
OnboardingController.php [FIX] InviteController requireRole→requireSuperAdmin + OnboardingController add RateLimitService 2026-03-10 15:54:16 +01:00
OrganizationController.php [FIX][SEC] Connettori: autorizzazione per-org + secret allowlist (findings review multi-agente) 2026-05-30 11:37:25 +02:00
PolicyController.php [FIX] P2/P3: aggiunti i metodi+route realmente mancanti (commit precedenti incompleti) 2026-05-30 10:36:39 +02:00
RiskController.php [FIX] FAIR/KRI: aggiunti i metodi mancanti in RiskController (commit 1be3bd0 era incompleto) 2026-05-30 09:29:36 +02:00
ServicesController.php [FIX] OpenAPI: 4 endpoint inbound (incidents/evidence/assets ingest + controls-monitoring) + tag Ingestion 2026-05-30 10:04:57 +02:00
SupplyChainController.php [FIX] SupplyChain: aggiunti i 5 metodi self-assessment (Edit precedente rifiutato per file non letto) 2026-05-30 10:39:24 +02:00
TrainingController.php [CORE] Initial project scaffold - NIS2 Agile Compliance Platform 2026-02-17 17:50:18 +01:00
WebhookController.php [FIX] Database::execute() → Database::query() in 5 controller 2026-03-07 16:49:58 +01:00
WhistleblowingController.php [FIX] Database::execute() → Database::query() in 5 controller 2026-03-07 16:49:58 +01:00