Merge pull request #496 from akhandpratapsingh88/Akhand@hcl-Accelerator-security-vulnerabilities-fixes

Fix for Important Security vulnerabilities

Author: santhoshb-msft

src/AdminSite/Controllers/ApplicationLogController.cs

@@ -4,11 +4,13 @@
 using Marketplace.SaaS.Accelerator.DataAccess.Contracts;
 using Marketplace.SaaS.Accelerator.DataAccess.Entities;
 using Marketplace.SaaS.Accelerator.Services.Services;
+using Marketplace.SaaS.Accelerator.Services.Utilities;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
 
 namespace Marketplace.SaaS.Accelerator.AdminSite.Controllers;
 
+[ServiceFilter(typeof(KnownUserAttribute))]
 public class ApplicationLogController : BaseController
 {
     private readonly ILogger<ApplicationLogController> logger;

src/CustomerSite/Controllers/HomeController.cs

@@ -404,6 +404,13 @@ public IActionResult SubscriptionLogDetail(Guid subscriptionId)
         {
             if (this.User.Identity.IsAuthenticated)
             {
+                // Validate subscription from same customer
+                var subscriptionDetail = this.subscriptionService.GetPartnerSubscription(this.CurrentUserEmailAddress, subscriptionId).FirstOrDefault();
+                if(subscriptionDetail == null)
+                {
+                    return this.RedirectToAction(nameof(this.Index));
+                }
+
                 List<SubscriptionAuditLogs> subscriptionAudit = new List<SubscriptionAuditLogs>();
                 subscriptionAudit = this.subscriptionLogRepository.GetSubscriptionBySubscriptionId(subscriptionId).ToList();
                 return this.PartialView(subscriptionAudit);