parsa/canina
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security(products): sanitize wholesalePrice for non-B2B/Admin roles [TASK-19.1]

Browse Source
This commit is contained in:
parsa aghaei 2026-08-03 11:50:20 +03:30
parent e30452d6cb
commit 67bc500692
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
backend/src/products/products.service.ts
View File

@ -90,7 +90,7 @@ export class ProductsService {
]);
const isWholesaleOrAdmin =
userRole === 'User_Wholesale' || userRole === 'ADMIN';
userRole === 'User_Wholesale' || userRole === 'User_Partner' || userRole === 'ADMIN' || userRole === 'SuperAdmin';
const data = rawProducts.map((p) => {
if (!isWholesaleOrAdmin) {
const { wholesalePrice, ...rest } = p;
@ -125,7 +125,7 @@ export class ProductsService {
if (!product) return null;
const isWholesaleOrAdmin =
userRole === 'User_Wholesale' || userRole === 'ADMIN';
userRole === 'User_Wholesale' || userRole === 'User_Partner' || userRole === 'ADMIN' || userRole === 'SuperAdmin';
if (!isWholesaleOrAdmin) {
const { wholesalePrice, ...rest } = product;
return rest;