Description
Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
crater-invoice Crater
Default version status: unknown
6.0.6affected