FOSSBilling: Broken Authorization in Client Transaction and Order Listings

An authenticated client sends crafted requests to the `client/invoice/transaction_get_list` endpoint (using the `search` parameter) or the `client/order/get_list` endpoint (using the `show_action_required` parameter) [ref_id=1]. Because the OR-based filters are appended without grouping, SQL operator precedence causes the OR clauses to be evaluated separately from the mandatory `client_id` WHERE condition, letting the query return records belonging to other clients [ref_id=1]. The attacker must be an authenticated client of the system but does not require any special administrative privileges.

The flaw resides in `ServiceTransaction::getSearchQuery()` and `Order\Service::getSearchQuery()` in the backend files `src/modules/Invoice/ServiceTransaction.php` and `src/modules/Order/Service.php` [ref_id=1]. OR-based search/action filters were appended without grouping, allowing SQL operator precedence to evaluate OR clauses independently of the enforced `client_id` constraint [ref_id=1].

The patch (version 0.8.0) wraps the OR-based search/action filter clauses in explicit parentheses so that they are grouped together and evaluated as a single condition alongside the mandatory `client_id` constraint [ref_id=1]. This prevents SQL operator precedence from allowing the OR clauses to bypass the tenant-scoping WHERE clause. The advisory does not include a diff, but the fix ensures that all client-list queries respect the authenticated client's scope.