Security: Missing workspace authorization check when creating Server records

[Snider]

Description

The Servers.php component creates new Server records without explicitly setting the workspace_id from the current authenticated user's workspace context.

Location

• File: src/View/Modal/Admin/Servers.php
• Lines: 101-125

Issue

When creating a new server, the code does not explicitly set the workspace_id:

The data array only includes: name, ip, port, user, status, and optionally private_key.

While the Server model has a BelongsToWorkspace trait, the workspace_id should be explicitly validated and set during creation to prevent:

1. Orphaned records if the global scope is not applied
2. IDOR vulnerabilities if workspace_id can be mass-assigned from request

Recommendation

1. Explicitly set workspace_id in the create data array
2. Ensure workspace_id is NOT in the fillable array (remove from mass assignment)
3. Add validation that the user belongs to the workspace being assigned

Severity

Medium - Could lead to data isolation issues in multi-tenant environment