mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-07-20 21:14:30 -05:00
kolaenteandkolaente
808ef2534e
TaskComment.Update used tc.Author as the TaskCommentUpdatedEvent doer, but that field is bound from the request body. A client could omit it (nil doer, breaking the event) or spoof another user. Resolve the doer from the session auth via GetUserOrLinkShareUser instead, mirroring Create and Delete. CanUpdate already guarantees the authenticated user is the comment's author, so this is both correct and consistent. Affects v1 and v2, which share the model.