penpot

mirror of https://github.com/penpot/penpot.git synced 2026-08-08 13:58:35 +00:00

History

Andrey Antukh 77033af34e 🐛 Scope assemble-chunks session lookup to profile-id

Prevent BOLA in chunked upload assembly by verifying session
ownership. The assemble-chunks function now requires a profile-id
parameter and scopes the upload_session lookup accordingly, matching
the pattern already used by upload-chunk.

All three callers (assemble-file-media-object, create-font-variant,
import-binfile) updated to pass the authenticated profile-id.

AI-assisted-by: mimo-v2.5-pro

2026-08-03 16:30:06 +00:00

dev

♻️ Refactor internal organization of system initialization

2026-07-22 14:18:51 +02:00

resources

♻️ Normalize organization naming across Penpot (#10977 )

2026-07-31 12:04:10 +02:00

scripts

♻️ Rename nitrate config to admin-console (#10929 )

2026-08-03 17:23:55 +02:00

src

🐛 Scope assemble-chunks session lookup to profile-id