kolaente e007a1da70 fix(api/v2): don't require read_one for autopatch's internal GET ...

Huma's AutoPatch implements PATCH as an internal GET + PUT re-dispatched through
the router, so both legs re-enter the API token middleware. Scoping the GET leg
like a client request made every /api/v2 PATCH additionally demand the
resource's read_one permission, so a token scoped to tasks: update could never
patch a task.

Mark the re-dispatched requests with the route the client request was matched
against, and skip the scope check only for a GET leg that carries no query
string and resolves to that exact route. Anything looser is exploitable: echo
routes on the raw path while autopatch re-dispatches the decoded one, so an
encoded slash steers the unchecked leg onto a deeper route and an encoded
question mark smuggles a query onto it.

Fixes #3528

2026-08-19 13:01:59 +02:00

..

fixtures

fix(api/v2): don't require read_one for autopatch's internal GET

2026-08-19 13:01:59 +02:00

db_path_test.go

…

db_test.go

fix(postgres): resolve all statements against the configured schema (#3156)

2026-07-11 18:02:57 +02:00

db.go

feat: expose database connection pool stats as prometheus metrics

2026-08-16 17:57:52 +02:00

dump_test.go

fix(dump): parse dumped time strings so restore works on MySQL and MariaDB

2026-07-30 21:15:19 +02:00

dump.go

fix(dump): parse dumped time strings so restore works on MySQL and MariaDB

2026-07-30 21:15:19 +02:00

helpers_test.go

test: call real MultiFieldSearch function and branch on db engine

2026-03-05 13:57:05 +01:00

helpers.go

feat(search): boost title matches 1.5x over description matches

2026-07-06 15:45:55 +00:00

test_fixtures.go

…

test.go

…