penpot

mirror of https://github.com/penpot/penpot.git synced 2026-09-25 13:26:16 +00:00

History

Andrey Antukh 8806f92cd7 🐛 Validate font-id team ownership in create-font-variant

Prevent cross-team font injection by checking that when a font-id
already has variants, they belong to the same team. This closes a
BOLA gap where a user with team edit permissions could create a
font variant referencing a font-id from another team.

AI-assisted-by: mimo-v2.5-pro

2026-08-03 18:26:47 +02:00

dev

♻️ Refactor internal organization of system initialization

2026-07-22 14:18:51 +02:00

resources

♻️ Normalize organization naming across Penpot (#10977 )

2026-07-31 12:04:10 +02:00

scripts

♻️ Rename nitrate config to admin-console (#10929 )

2026-08-03 17:23:55 +02:00

src

🐛 Validate font-id team ownership in create-font-variant