Andrey Antukh 52573be074

🐛 Enforce share-link page scope in get-page and get-file-fragment RPC commands (#11284) ...

The get-page RPC command did not validate that the requested page-id was within the share-link's authorized :pages set, allowing share-link holders to read out-of-scope pages. The get-file-fragment command had the same issue.

This fix adds page scope validation to get-page, rejecting requests for pages not in the share-link's :pages set with a :not-found error. For get-file-fragment, share-link access is denied entirely as fragments lack direct page-id mapping.

The fix aligns these commands with the existing correct behavior in get-view-only-bundle, which already filters pages based on share-link scope.

Closes #11281

AI-assisted-by: qwen3.7-plus

2026-08-25 09:37:42 +02:00

..

backend_tests

🐛 Enforce share-link page scope in get-page and get-file-fragment RPC commands (#11284)

2026-08-25 09:37:42 +02:00

e2e

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00