fix: fix security issue in resetcompany.php

[anupamme]

Summary

Fix critical severity security issue in src/resetcompany.php.

Vulnerability

Field	Value
ID	V-002
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-002
File	src/resetcompany.php:31
Assessment	Likely exploitable
Chain Complexity	2-step

Description: The application performs destructive delete operations after only verifying the user is logged in, without checking if the user has permission to delete the specific company or accounting period. Any authenticated user can delete any company's data by manipulating session values or request parameters.

Evidence

Exploitation scenario: Low-privilege authenticated user accesses resetcompany.php or ucetniobdobi.php with manipulated parameters.

Scanner confirmation: multi_agent_ai rule V-002 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a local CLI tool - exploitation requires the attacker to control command-line arguments or input files.

Changes

• src/resetcompany.php

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

---

Automated security fix by OrbisAI Security

Summary by CodeRabbit

• Security
  • Restricted access to the company reset page to administrators in addition to requiring a logged-in account.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 83e278fc-6b89-4667-b82f-6fcf24861e8b

📥 Commits

Reviewing files that changed from the base of the PR and between 50c626c and e2fda50.

📒 Files selected for processing (1)

• src/resetcompany.php

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The company reset page now checks admin authorization after checking login status. The reset workflow proceeds only after both checks pass.

Changes

Company reset authorization

Layer / File(s)	Summary
Add admin authorization src/resetcompany.php	The reset page calls onlyForAdmin() after onlyForLogged().

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: 🟠 High · up to e2fda

Non-admin users may still trigger company data deletion despite the new check, so this authorization fix is not safe to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies a security fix in the affected file. It matches the main change, although the repeated word "fix" is slightly redundant.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}