mirror of https://github.com/reconurge/flowsint.git synced 2026-11-08 14:35:41 -06:00

Files

T

History

dextmorgn dd9caf2cb1 fix(api): enforce object-level authorization on Flow update/delete/read

Flow update, delete, and ID-based read never checked caller identity
against the target record, so any authenticated user could tamper with
or delete another user's Flow by UUID, and the list endpoint returned
every user's flows unfiltered. Added a nullable owner_id column (NULL
= pre-existing flows, readable by all but not editable via the API),
stamp it on create, and check ownership in FlowService before mutating
or returning a single Flow.

Fixes GHSA-qvx2-6v5v-wwrg.

2026-08-23 13:10:11 +02:00

src/flowsint_core

fix(api): enforce object-level authorization on Flow update/delete/read

2026-08-23 13:10:11 +02:00

tests

fix(api): enforce object-level authorization on Flow update/delete/read

2026-08-23 13:10:11 +02:00

pyproject.toml

fix(security): bump dompurify and cryptography to patched versions

2026-06-21 16:39:21 +02:00

README.md

feat(core): switch to uv