penpot

mirror of https://github.com/penpot/penpot.git synced 2026-09-25 21:36:15 +00:00

History

Andrey Antukh aac8a69951 🐛 Require file read permissions for asset endpoints

Add authorization check to generic-handler in assets.clj so that
/assets/by-file-media-id/:id and its /thumbnail variant verify the
requesting profile has read access to the parent file. Return 404
(not 403) when access is denied to avoid confirming existence.

Also switch get-file-media-object from db/get to db/get* so that
non-existent media objects return nil instead of raising.

AI-assisted-by: qwen3.7-plus

2026-08-03 18:26:47 +02:00

dev

♻️ Refactor internal organization of system initialization

2026-07-22 14:18:51 +02:00

resources

🐛 Add concurrency limit to import-binfile RPC handler

2026-08-03 18:26:47 +02:00

scripts

♻️ Rename nitrate config to admin-console (#10929 )

2026-08-03 17:23:55 +02:00

src

🐛 Require file read permissions for asset endpoints