Merge branch 'develop' into nolanpro-patch-1

Author: nolanpro

ProcessMaker/Http/Controllers/Api/V1_1/CaseController.php

@@ -43,6 +43,17 @@ public function __construct(private Request $request, CaseApiRepository $caseRep
      */
     public function getAllCases(CaseListRequest $request): JsonResponse
     {
+        // Users are always allowed to view cases scoped to themselves
+        // Any broader query requires the `view-all_cases` permission.
+        // Admins pass through via Gate::before in AuthServiceProvider.
+        $authUser = Auth::user();
+        $requestedUserId = $request->filled('userId') ? (int) $request->input('userId') : null;
+        $isViewingOwnCases = $requestedUserId !== null && $requestedUserId === $authUser->id;
+
+        if (!$isViewingOwnCases && !$authUser->can('view-all_cases')) {
+            abort(403);
+        }
+
         $query = $this->caseRepository->getAllCases($request);
 
         return $this->paginateResponse($query);

ProcessMaker/Http/Controllers/CasesController.php

@@ -22,10 +22,21 @@ class CasesController extends Controller
     /**
      * Get the list of requests.
      *
+     * @param string|null $type One of `all|in_progress|completed` (constrained by the route).
+     *
      * @return \Illuminate\View\View|\Illuminate\Contracts\View
      */
-    public function index()
+    public function index($type = null)
     {
+        // The "All cases" tab exposes every case in the platform regardless
+        // of the user's relationship to it, so it is gated by the
+        // `view-all_cases` permission. The other tabs (My cases, In progress,
+        // Completed) are scoped to the user and need no gate.
+        // Admins bypass this check via Gate::before in AuthServiceProvider.
+        if ($type === 'all' && !Auth::user()->can('view-all_cases')) {
+            abort(403);
+        }
+
         $manager = app(ScreenBuilderManager::class);
         event(new ScreenBuilderStarting($manager, 'FORM'));
         $currentUser = Auth::user()->only(['id', 'username', 'fullname', 'firstname', 'lastname', 'avatar']);

composer.json

@@ -1,6 +1,6 @@
 {
     "name": "processmaker/processmaker",
-    "version": "2026.8.2",
+    "version": "2026.9.1",
     "description": "BPM PHP Software",
     "keywords": [
         "php bpm processmaker"
@@ -113,7 +113,7 @@
             "Gmail"
         ],
         "processmaker": {
-            "build": "90d83217",
+            "build": "5c91234c",
             "cicd-enabled": true,
             "custom": {
                 "package-ellucian-ethos": "1.19.10",
@@ -155,9 +155,9 @@
                 "connector-slack": "1.9.6",
                 "docker-executor-node-ssr": "1.7.4",
                 "package-ab-testing": "1.4.2",
-                "package-actions-by-email": "1.22.13",
+                "package-actions-by-email": "1.22.14",
                 "package-advanced-user-manager": "1.13.3",
-                "package-ai": "1.16.17",
+                "package-ai": "1.16.18",
                 "package-analytics-reporting": "1.11.5",
                 "package-auth": "1.24.15",
                 "package-collections": "2.27.6",
@@ -166,7 +166,7 @@
                 "package-data-sources": "1.34.10",
                 "package-decision-engine": "1.16.3",
                 "package-dynamic-ui": "1.28.4",
-                "package-email-start-event": "1.0.11",
+                "package-email-start-event": "1.0.12",
                 "package-files": "1.23.6",
                 "package-googleplaces": "1.12.1",
                 "package-photo-video": "1.6.3",
@@ -176,7 +176,7 @@
                 "package-product-analytics": "1.5.11",
                 "package-projects": "1.12.9",
                 "package-rpa": "1.1.2",
-                "package-savedsearch": "1.43.12",
+                "package-savedsearch": "1.43.13",
                 "package-slideshow": "1.4.3",
                 "package-smart-extract": "0.0.6",
                 "package-signature": "1.15.5",
@@ -250,4 +250,4 @@
             "ignore": []
         }
     }
-}
+}

database/migrations/2026_05_19_102552_update_passport_schema.php

@@ -55,8 +55,7 @@ public function run(ClientRepository $clients)
         ]);
 
         // Create client so we can generate tokens
-        $personalAccessClient = $clients->createPersonalAccessGrantClient('PmApi');
-        $personalAccessClient->save();
+        $clients->createPersonalAccessGrantClient('PmApi');
 
         // Create client OAuth (for 3-legged auth) - Authorization Code Grant for Swagger UI
         $clients->createAuthorizationCodeGrantClient(

database/seeders/UserSeeder.php

@@ -1,6 +1,6 @@
 {
     "name": "@processmaker/processmaker",
-    "version": "2026.8.2",
+    "version": "2026.9.1",
     "description": "ProcessMaker 4",
     "author": "DevOps <devops@processmaker.com>",
     "license": "ISC",
@@ -61,9 +61,9 @@
         "@fortawesome/free-solid-svg-icons": "^5.15.1",
         "@fortawesome/vue-fontawesome": "^0.1.9",
         "@panter/vue-i18next": "^0.15.2",
-        "@processmaker/modeler": "1.69.40",
+        "@processmaker/modeler": "1.69.41",
         "@processmaker/processmaker-bpmn-moddle": "0.16.1",
-        "@processmaker/screen-builder": "3.8.34",
+        "@processmaker/screen-builder": "3.8.35",
         "@processmaker/vue-form-elements": "0.65.8",
         "@processmaker/vue-multiselect": "2.3.2",
         "@tinymce/tinymce-vue": "2.0.0",

package-lock.json

@@ -2,6 +2,8 @@
 
 namespace Tests\Feature\Api\V1_1;
 
+use Illuminate\Support\Facades\Gate;
+use ProcessMaker\Models\Permission;
 use ProcessMaker\Models\User;
 use ProcessMaker\Repositories\CaseUtils;
 use Tests\Feature\Shared\RequestHelper;
@@ -16,6 +18,17 @@ public function setUp(): void
         parent::setUp();
 
         $this->user = CaseControllerTest::createUser('user_a');
+
+        // These tests intentionally exercise the unscoped `get_all_cases`
+        // endpoint, which now requires `view-all_cases`. Grant the
+        // non-admin test user the permission so each `apiCall` reaches
+        // the search logic rather than being short-circuited with a 403.
+        Permission::firstOrCreate(
+            ['name' => 'view-all_cases'],
+            ['title' => 'View All Cases'],
+        );
+        Gate::define('view-all_cases', fn ($user) => $user->hasPermission('view-all_cases'));
+        $this->user->giveDirectPermission('view-all_cases');
     }
 
     public function tearDown(): void