Fix cart authorization bypass

src/Sylius/Bundle/ApiBundle/CommandHandler/Cart/AddItemToCartHandler.php

@@ -14,16 +14,19 @@ declare(strict_types=1);
 namespace Sylius\Bundle\ApiBundle\CommandHandler\Cart;
 
 use Sylius\Bundle\ApiBundle\Command\Cart\AddItemToCart;
+use Sylius\Bundle\ApiBundle\Context\UserContextInterface;
 use Sylius\Bundle\ApiBundle\Exception\ProductVariantUnprocessableException;
 use Sylius\Bundle\ApiBundle\Exception\UnprocessableCartException;
 use Sylius\Component\Core\Factory\CartItemFactoryInterface;
 use Sylius\Component\Core\Model\OrderInterface;
 use Sylius\Component\Core\Model\OrderItemInterface;
 use Sylius\Component\Core\Model\ProductVariantInterface;
+use Sylius\Component\Core\Model\ShopUserInterface;
 use Sylius\Component\Core\Repository\OrderRepositoryInterface;
 use Sylius\Component\Core\Repository\ProductVariantRepositoryInterface;
 use Sylius\Component\Order\Modifier\OrderItemQuantityModifierInterface;
 use Sylius\Component\Order\Modifier\OrderModifierInterface;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Symfony\Component\Messenger\Attribute\AsMessageHandler;
 
 #[AsMessageHandler]
@@ -39,6 +42,7 @@ final readonly class AddItemToCartHandler
         private OrderModifierInterface $orderModifier,
         private CartItemFactoryInterface $cartItemFactory,
         private OrderItemQuantityModifierInterface $orderItemQuantityModifier,
+        private ?UserContextInterface $userContext = null,
     ) {
     }
 
@@ -58,6 +62,8 @@ final readonly class AddItemToCartHandler
             throw new UnprocessableCartException();
         }
 
+        $this->assertCartAccessible($cart);
+
         /** @var OrderItemInterface $cartItem */
         $cartItem = $this->cartItemFactory->createNew();
         $cartItem->setVariant($productVariant);
@@ -67,4 +73,36 @@ final readonly class AddItemToCartHandler
 
         return $cart;
     }
+
+    private function assertCartAccessible(OrderInterface $cart): void
+    {
+        if (null === $this->userContext) {
+            return;
+        }
+
+        $currentUser = $this->userContext->getUser();
+
+        if (null === $currentUser) {
+            return;
+        }
+
+        if ($cart->isCreatedByGuest()) {
+            return;
+        }
+
+        $cartCustomer = $cart->getCustomer();
+
+        if (null === $cartCustomer || null === $cartCustomer->getUser()) {
+            return;
+        }
+
+        if (
+            $currentUser instanceof ShopUserInterface
+            && $currentUser->getCustomer()?->getId() === $cartCustomer->getId()
+        ) {
+            return;
+        }
+
+        throw new NotFoundHttpException('Cart not found.');
+    }
 }

src/Sylius/Bundle/ApiBundle/Resources/config/services/command_handlers.xml

@@ -44,6 +44,7 @@
             <argument type="service" id="sylius.modifier.order" />
             <argument type="service" id="sylius.factory.order_item" />
             <argument type="service" id="sylius.modifier.order_item_quantity" />
+            <argument type="service" id="Sylius\Bundle\ApiBundle\Context\UserContextInterface" />
             <tag name="messenger.message_handler" bus="sylius.command_bus" />
         </service>