mirror of
https://github.com/penpot/penpot.git
synced 2026-09-02 01:59:17 +00:00
15195b3bbb
* 🐛 Filter share-link tokens in get-view-only-bundle response The get-view-only-bundle RPC command returned all share-link tokens for a file, allowing an anonymous holder of a restrictive share-link to enumerate and use more permissive tokens. When authenticating via a share-link, the response now only includes the share-link used for authentication, preventing token disclosure and scope escalation. Implemented using TDD: - RED: Test demonstrates vulnerability (all tokens visible) - GREEN: Filter share-links when (:type perms) = :share-link - Verified all existing tests still pass Closes #11285 AI-assisted-by: qwen3.7-plus * 🐛 Add membership-side test for share-link token visibility Add test coverage for the allow side of the share-link token filtering: team members and file owners should still see all share-links, while anonymous share-link holders only see their own token. This protects the (:type perms) = :share-link guard from accidental regression that could break the owner's share-link management dialog. AI-assisted-by: qwen3.7-plus