Andrey Antukh 90853808f8 🐛 Enforce share-link comment permissions and page scope ...

Fix two security vulnerabilities in comment RPCs when accessed
via share-links:

- GHSA-4p97-v4wg-jxfx: Share-link holders with who-comment=team
  could bypass the restriction and comment. The check-comment-permissions!
  function treated can-read as sufficient, but share-links always set
  can-read=true.

- GHSA-fwm4-hm9f-rmcp: Comment query RPCs returned threads from all
  pages, ignoring the share-link's :pages restriction.

Changes:
- files.clj: Differentiate :membership vs :share-link in
  check-comment-permissions!. For share-links, require
  has-comment-permissions? only (who-comment=all).
- comments.clj: Filter threads by (:pages perms) for share-link
  access in get-comment-threads, get-comment-thread, and get-comments.

Closes #11370

AI-assisted-by: qwen3.7-plus

2026-08-26 19:48:03 +02:00

..

backend_tests

🐛 Enforce share-link comment permissions and page scope

2026-08-26 19:48:03 +02:00

e2e

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00