From f1428d72c2bb4eeecbac2c23b4e54b8f1009bde0 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com>
Date: Thu, 4 Apr 2024 01:00:14 -0700
Subject: [PATCH] Fix: Security vulnurbility making it possible to spoof env &
 secret path requested.

---
 backend/src/ee/routes/v1/access-approval-request-router.ts | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/backend/src/ee/routes/v1/access-approval-request-router.ts b/backend/src/ee/routes/v1/access-approval-request-router.ts
index 2a6142c88..4b173cfa7 100644
--- a/backend/src/ee/routes/v1/access-approval-request-router.ts
+++ b/backend/src/ee/routes/v1/access-approval-request-router.ts
@@ -16,9 +16,7 @@ export const registerAccessApprovalRequestRouter = async (server: FastifyZodProv
         temporaryRange: z.string().optional()
       }),
       querystring: z.object({
-        projectSlug: z.string().trim(),
-        secretPath: z.string().trim(),
-        envSlug: z.string().trim()
+        projectSlug: z.string().trim()
       }),
       response: {
         200: z.object({
@@ -33,9 +31,7 @@ export const registerAccessApprovalRequestRouter = async (server: FastifyZodProv
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,
         permissions: req.body.permissions,
-        envSlug: req.query.envSlug,
         actorOrgId: req.permission.orgId,
-        secretPath: req.query.secretPath,
         projectSlug: req.query.projectSlug,
         temporaryRange: req.body.temporaryRange,
         isTemporary: req.body.isTemporary