Repository navigation
Fix/unsubscribe sql params - #67
Merged
Merged
Conversation
The unauthenticated unsubscribe endpoint interpolated the token's notification_type into the jsonb_set path and key. Pass it as a bound parameter instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…omments create-comment never checked the target's comments_enabled setting, and only rejected authors the target had blocked, not targets the author had blocked. Check the switch (the owner is exempt) and use the shared assertNotBlocked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A member could set their avatar or photos to an image on their own server. Raw <img> tags and the new-message email then load it straight from viewers' browsers and mail clients, revealing their IP addresses and acting as a read receipt. isOwnImageUrl accepts only objects in our own Storage buckets (checked by bucket, since the Google storage hosts serve anyone's) and /images/ on our own site. It is enforced on pinned_url, photo_urls and me/update avatarUrl, used when an import picks a photo to pin, and applied at render time in the avatar widget, the raw <img> tags and the emails so rows saved before this change are neutralised too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
save-subscription and save-subscription-mobile reassigned an existing endpoint or token to the caller, so anyone holding another member's could redirect their notifications (or overwrite the web push keys). Rows owned by someone else are now left alone. Since a shared device no longer moves to the next member on its own, sign-out now removes this device's subscription through a new delete-subscription endpoint, before the session ends. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The anon-callable function already redacted members-only profiles, but a disabled profile with public visibility still came back in full. Redact those too, keeping the disabled flag so the page can still say so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
vote_results and votes were readable with the public anon key, exposing every member's ballot and the authors of anonymous proposals, and get_profile_stars told anyone who a member had starred. Drop the public-read policies and grants, and move the client's reads to: get_votes_with_results (security definer, creator hidden on anonymous proposals), get-my-vote-choices and get-my-stars endpoints for the caller's own data, and /stats for proposal and ballot counts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Authorship alone let a member rewrite or delete their messages after leaving the chat or being blocked, e.g. to alter the messages the other person was about to report. edit-message and delete-message now share getChangeableOwnMessage, which applies the same membership and block checks as posting. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
get-profiles with compatibleWithUserId set to someone else paged through that member's compatibility scores, bypassing the block and visibility checks of compatible-profiles. It now answers 403 unless the caller is that member or an admin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Picks up banned_networks and donations, and drops compatibility_answers_free. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Caution Review failedThe pull request is closed. Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.