Andrey Antukh cff9939552 🐛 Verify read access on source file in clone-file-media-object ...

The clone-file-media-object RPC command only checked edit permissions
on the destination file. The source media object was fetched directly
by UUID without verifying the caller had access to the file that owns
it.

This fix adds a read permission check on the source file before
cloning. If the caller lacks read access to the source file, the
operation fails with :not-found to avoid leaking information about
the existence of files/media the caller cannot access.

Closes #11087

AI-assisted-by: qwen3.7-plus

2026-08-05 10:49:52 +00:00

..

dev

♻️ Refactor internal organization of system initialization

2026-07-22 14:18:51 +02:00

resources

♻️ Normalize organization naming across Penpot (#10977)

2026-07-31 12:04:10 +02:00

scripts

✨ Add media-processor service for image and font processing (#10767)

2026-08-05 09:41:48 +02:00

src

🐛 Verify read access on source file in clone-file-media-object

2026-08-05 10:49:52 +00:00

test

🐛 Verify read access on source file in clone-file-media-object

2026-08-05 10:49:52 +00:00

build.clj

🐛 Fix unexpected exception on logger caused by log4j2 plugin

2023-02-11 00:52:23 +01:00

deps.edn

⬆️ Update dependencies (#10982)

2026-07-31 18:53:05 +02:00

package.json

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00

pnpm-lock.yaml

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00

pnpm-workspace.yaml

⬆️ Update pnpm dependencies across all modules

2026-08-04 14:15:35 +02:00

tests.edn

🔧 Change backend test runner to kaocha

2024-05-29 19:05:04 +02:00