Andrey Antukh 25066c2f46

🐛 Require file read permissions for asset endpoints (#11036) ...

Add authorization check to generic-handler in assets.clj so that
/assets/by-file-media-id/:id and its /thumbnail variant verify the
requesting profile has read access to the parent file. Return 404
(not 403) when access is denied to avoid confirming existence.

Also switch get-file-media-object from db/get to db/get* so that
non-existent media objects return nil instead of raising.

AI-assisted-by: mimo-v2.5-pro

2026-08-05 17:44:01 +02:00

..

app

🐛 Require file read permissions for asset endpoints (#11036)

2026-08-05 17:44:01 +02:00

data_readers.clj

🐛 Set correct name to tokens lib data reader

2025-10-13 18:41:02 +02:00