Andrey Antukh 77033af34e 🐛 Scope assemble-chunks session lookup to profile-id ...

Prevent BOLA in chunked upload assembly by verifying session
ownership. The assemble-chunks function now requires a profile-id
parameter and scopes the upload_session lookup accordingly, matching
the pattern already used by upload-chunk.

All three callers (assemble-file-media-object, create-font-variant,
import-binfile) updated to pass the authenticated profile-id.

AI-assisted-by: mimo-v2.5-pro

2026-08-03 16:30:06 +00:00

..

test_files

Merge remote-tracking branch 'origin/main' into staging

2026-05-10 09:16:41 +02:00

auth_oidc_test.clj

Merge remote-tracking branch 'origin/staging' into develop

2026-07-20 11:48:26 +02:00

binfile_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

bounce_handling_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

db_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

email_blacklist_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

email_sending_test.clj

♻️ Normalize organization naming across Penpot (#10977)

2026-07-31 12:04:10 +02:00

helpers.clj

♻️ Refactor nitrate audit method and tests

2026-07-22 13:11:57 +02:00

http_assets_test.clj

🐛 Make organization logos publicly accessible for invitation emails (#10831)

2026-07-24 14:08:41 +02:00

http_management_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

http_middleware_security.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

http_middleware_test.clj

🐛 Handle unrecognized JSON escape sequences as malformed-json (#10808)

2026-07-31 12:06:19 +02:00

loggers_webhooks_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

logical_deletion_test.clj

✨ Inherit subscriptions perks to Nitrate

2026-06-02 09:33:02 +02:00

media_sanitize_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

media_test.clj

🐛 Return 400 instead of 500 when ImageMagick fails on invalid images (#10643)

2026-07-20 11:56:07 +02:00

rpc_access_tokens_test.clj

🐛 Prevent MCP tokens from being used as access tokens (#10962)

2026-07-31 13:19:45 +02:00

rpc_audit_test.clj

🐛 Fix audit event validation for error reports with string profile-id (#10898)

2026-07-30 07:32:02 +02:00

rpc_commands_error_reports_test.clj

🐛 Fix audit event validation for error reports with string profile-id (#10898)

2026-07-30 07:32:02 +02:00

rpc_comment_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

rpc_cond_middleware_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

rpc_doc_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

rpc_file_snapshot_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

rpc_file_test.clj

🐛 Fix several issues in RPC command handlers (#10670)

2026-07-28 10:59:16 +02:00

rpc_file_thumbnails_test.clj

Merge remote-tracking branch 'origin/staging' into develop

2026-06-15 13:04:19 +02:00

rpc_font_test.clj

Merge remote-tracking branch 'origin/main' into staging

2026-06-01 12:57:39 +02:00

rpc_management_nitrate_test.clj

♻️ Rename nitrate config to admin-console (#10929)

2026-08-03 17:23:55 +02:00

rpc_management_test.clj

✨ Avoid deduplicating temporary export files (#9959)

2026-06-03 14:08:10 +02:00

rpc_media_test.clj

🐛 Scope assemble-chunks session lookup to profile-id

2026-08-03 16:30:06 +00:00

rpc_nitrate_test.clj

♻️ Rename nitrate config to admin-console (#10929)

2026-08-03 17:23:55 +02:00

rpc_organization_owner_permissions_test.clj

♻️ Rename nitrate config to admin-console (#10929)

2026-08-03 17:23:55 +02:00

rpc_profile_test.clj

🐛 Restrict update-profile-props to documented keys only (#10992)

2026-08-03 17:27:09 +02:00

rpc_project_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

rpc_quotes_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

rpc_team_test.clj

♻️ Rename nitrate config to admin-console (#10929)

2026-08-03 17:23:55 +02:00

rpc_viewer_test.clj

Merge remote-tracking branch 'origin/main' into staging

2026-06-01 12:57:39 +02:00

rpc_webhooks_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

shell_test.clj

🐛 Fix backend util shell tests

2026-07-09 19:34:15 +02:00

storage_test.clj

✨ Avoid deduplicating temporary export files (#9959)

2026-06-03 14:08:10 +02:00

tasks_telemetry_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

util_blob_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

util_objects_map_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

util_pointer_map_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

util_ssrf_test.clj

Merge remote-tracking branch 'origin/main' into staging

2026-06-01 12:57:39 +02:00