Switching off a till that is not yours
The screen that decides what a venue has — till, stock, rota, payments — checked what kind of account you were and never which venue you named. One word, spelled two ways, was the whole difference.
Every venue on our system has a set of things switched on: the till, stock, the rota, payments. A hall operator can change those for a kitchen, because it is their hall. That is the intended behaviour and it is useful.
What we found is that the route doing it checked what kind of account you were — owner, hall operator, manager — and never checked which venue the request actually named. So an account at one kitchen could have switched off another kitchen’s till. A hall operator could have done it to every kitchen in a hall that was not theirs, in the middle of service.
One word, spelled two ways
The reason it slipped through is the part worth writing down, because it will happen to somebody else.
We have a single gate that sits in front of every request and works out which venue it is about, so individual screens do not each have to remember. It is careful, and it has been widened twice before after somebody attacked it rather than read it. It collects the venue id from the query string, from the request body, from two differently-named fields a stock transfer uses, and from the URL path.
It matches on the name of the field. This particular screen
calls the venue scope_id, because it can also apply to a whole hall.
That spelling was not on the list, so the gate never fired.
The proof that this is exactly the cause and not a theory sits in the same
file: the neighbouring route that sets up a brand new vendor calls it
site_id, is covered by the gate, and needs no check of its own. One
word is the whole difference between the two.
The same spelling, on the money screen
Having found it, we looked for the other place that spelling is used. There is exactly one: the screen that sets commission rates. A rate can apply to the whole platform, one hall, one company or one kitchen — and the check compared the id against the caller for one of those four. So a hall operator could have written a commission rate onto a kitchen in somebody else’s hall, and the payout run would have billed it.
Nothing has been mispriced: there are five live rates and none of them is kitchen-level. Found before the first one, which is the only cheap time.
The question for anybody buying
“Can a vendor see another vendor’s data” is the question everybody asks. The better one is can a vendor change another vendor’s settings — and specifically the settings that decide whether their equipment works at all. Reading somebody’s sales is bad. Turning off their till at seven on a Friday is a different kind of bad.