Andrey Antukh e57d949a7e 🐛 Filter share-link tokens in get-view-only-bundle response ...

The get-view-only-bundle RPC command returned all share-link tokens for a file, allowing an anonymous holder of a restrictive share-link to enumerate and use more permissive tokens.

When authenticating via a share-link, the response now only includes the share-link used for authentication, preventing token disclosure and scope escalation.

Implemented using TDD:
- RED: Test demonstrates vulnerability (all tokens visible)
- GREEN: Filter share-links when (:type perms) = :share-link
- Verified all existing tests still pass

Closes #11285

AI-assisted-by: qwen3.7-plus

2026-08-19 11:36:31 +00:00

..

dev

♻️ Refactor internal organization of system initialization

2026-07-22 14:18:51 +02:00

resources

🐛 Add concurrency limit to import-binfile RPC handler (#11024)

2026-08-17 11:08:07 +02:00

scripts

✨ Add media-processor service for image and font processing (#10767)

2026-08-05 09:41:48 +02:00

src

🐛 Filter share-link tokens in get-view-only-bundle response

2026-08-19 11:36:31 +00:00

test

🐛 Filter share-link tokens in get-view-only-bundle response

2026-08-19 11:36:31 +00:00

build.clj

🐛 Fix unexpected exception on logger caused by log4j2 plugin

2023-02-11 00:52:23 +01:00

deps.edn

🐛 Add backend password validation with complexity rules and dictionary check (#11059)

2026-08-06 10:17:14 +02:00

package.json

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00

pnpm-lock.yaml

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00

pnpm-workspace.yaml

⬆️ Update pnpm dependencies across all modules

2026-08-04 14:15:35 +02:00

tests.edn

🔧 Change backend test runner to kaocha

2024-05-29 19:05:04 +02:00