{"action":"created","issue":{"url":"https://api.github.com/repos/snipe/snipe-it/issues/23","labels_url":"https://api.github.com/repos/snipe/snipe-it/issues/23/labels{/name}","comments_url":"https://api.github.com/repos/snipe/snipe-it/issues/23/comments","events_url":"https://api.github.com/repos/snipe/snipe-it/issues/23/events","html_url":"https://github.com/snipe/snipe-it/issues/23","id":22811217,"number":23,"title":"Support multiple companies [$500]","user":{"login":"snipe","id":197404,"avatar_url":"https://avatars.githubusercontent.com/u/197404?v=3","gravatar_id":"","url":"https://api.github.com/users/snipe","html_url":"https://github.com/snipe","followers_url":"https://api.github.com/users/snipe/followers","following_url":"https://api.github.com/users/snipe/following{/other_user}","gists_url":"https://api.github.com/users/snipe/gists{/gist_id}","starred_url":"https://api.github.com/users/snipe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snipe/subscriptions","organizations_url":"https://api.github.com/users/snipe/orgs","repos_url":"https://api.github.com/users/snipe/repos","events_url":"https://api.github.com/users/snipe/events{/privacy}","received_events_url":"https://api.github.com/users/snipe/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/snipe/snipe-it/labels/bounty","name":"bounty","color":"129e5e"},{"url":"https://api.github.com/repos/snipe/snipe-it/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/snipe/snipe-it/milestones/3","html_url":"https://github.com/snipe/snipe-it/milestones/v.3.0","labels_url":"https://api.github.com/repos/snipe/snipe-it/milestones/3/labels","id":487956,"number":3,"title":"v.3.0","description":"This is where I'm putting requests for non-MVP, non-1.0 stuff.","creator":{"login":"snipe","id":197404,"avatar_url":"https://avatars.githubusercontent.com/u/197404?v=3","gravatar_id":"","url":"https://api.github.com/users/snipe","html_url":"https://github.com/snipe","followers_url":"https://api.github.com/users/snipe/followers","following_url":"https://api.github.com/users/snipe/following{/other_user}","gists_url":"https://api.github.com/users/snipe/gists{/gist_id}","starred_url":"https://api.github.com/users/snipe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snipe/subscriptions","organizations_url":"https://api.github.com/users/snipe/orgs","repos_url":"https://api.github.com/users/snipe/repos","events_url":"https://api.github.com/users/snipe/events{/privacy}","received_events_url":"https://api.github.com/users/snipe/received_events","type":"User","site_admin":false},"open_issues":14,"closed_issues":6,"state":"open","created_at":"2013-11-18T01:52:57Z","updated_at":"2015-10-22T06:50:14Z","due_on":null,"closed_at":null},"comments":9,"created_at":"2013-11-18T01:53:57Z","updated_at":"2015-11-07T12:50:20Z","closed_at":null,"body":"This is a fringe case, but it just so happens to apply in my case. My IT team services two sister companies within a parent holding company. Adding this as an enhancement, but unless I hear from other folks who really want this, it's low priority for now.\r\n\r\n<bountysource-plugin>\r\n---\r\nThere is a **[$500 open bounty](https://www.bountysource.com/issues/2092769-support-multiple-companies?utm_campaign=plugin&utm_content=tracker%2F505106&utm_medium=issues&utm_source=github)** on this issue. Add to the bounty at [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F505106&utm_medium=issues&utm_source=github).\r\n</bountysource-plugin>"},"comment":{"url":"https://api.github.com/repos/snipe/snipe-it/issues/comments/154697920","html_url":"https://github.com/snipe/snipe-it/issues/23#issuecomment-154697920","issue_url":"https://api.github.com/repos/snipe/snipe-it/issues/23","id":154697920,"user":{"login":"Ahimta","id":3470403,"avatar_url":"https://avatars.githubusercontent.com/u/3470403?v=3","gravatar_id":"","url":"https://api.github.com/users/Ahimta","html_url":"https://github.com/Ahimta","followers_url":"https://api.github.com/users/Ahimta/followers","following_url":"https://api.github.com/users/Ahimta/following{/other_user}","gists_url":"https://api.github.com/users/Ahimta/gists{/gist_id}","starred_url":"https://api.github.com/users/Ahimta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Ahimta/subscriptions","organizations_url":"https://api.github.com/users/Ahimta/orgs","repos_url":"https://api.github.com/users/Ahimta/repos","events_url":"https://api.github.com/users/Ahimta/events{/privacy}","received_events_url":"https://api.github.com/users/Ahimta/received_events","type":"User","site_admin":false},"created_at":"2015-11-07T12:50:20Z","updated_at":"2015-11-07T12:50:20Z","body":"Hi @snipe, I just finished the initial implementation for multiple-companies support.\r\n\r\nYou can find the PR here: https://github.com/snipe/snipe-it/pull/1321\r\nAnd the screenshots and other related files here: https://www.dropbox.com/sh/wugnzqepwgzwlnh/AAAwNWA5hIKrP0y2VTu-LMHHa?dl=0\r\n\r\nI also fixed a security issue relating to CSRF in `AdminController` [here](https://github.com/Ahimta/snipe-it/commit/6bf2a2875f7da7e2d9740acbfb6b6ef8983ec343#diff-54d7b516dd9ce8144b2a9d367a1e50a4R17)\r\n\r\nIn addition, I noticed you have some other CSRF issues, pertaining mainly to using GET requests\r\ninstead of POST, PUT or DELETE. Mostly for deletion routes.\r\n\r\nNote that these issues still persist even if requests are authenticated.\r\nIn fact, [CSRF](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet) by definition, happens when the user is authenticated.\r\n\r\nIt may be tempting to use GET and pass a CSRF token as a query string.\r\nI would advise against it. Web browsers treat GET differently than other methods.\r\nSo in general (almost) never use GET for anything that changes the DB state,\r\nunless you really know what you're doing.\r\n\r\nAnd please don't use tabs `\\t` :)"}}