kolaente ce0d1355cf fix(security): reject link shares in Webhook.ReadAll ...

The guard on Webhook.CanRead is unreachable: no route exposes a read-one
webhook, and DoReadAll never calls CanRead. Two paths were left open:

- the v2 user-webhook list passes a.GetID() into Webhook.UserID, which is
  negative for a link share, so the w.UserID > 0 branch and its link share
  check were skipped and the request fell through to the project branch with
  project id 0, returning 404 instead of 403.
- the project branch never rejected link shares at all, so any holder of a
  public share link could list the project's webhooks. target_url is a bearer
  secret for Slack, Discord, Teams and Zapier.

Guard both by rejecting link shares at the top of ReadAll.

2026-08-04 13:40:11 +02:00

..

audit

feat(audit): audit full personal data export requests

2026-07-28 18:05:34 +02:00

caldav

fix(caldav): report completion status from Done instead of done_at

2026-07-30 11:32:24 +02:00

caldavtests

fix(caldav): stop corrupting percent signs in REPORT responses

2026-07-30 21:43:05 +02:00

cmd

fix(cli): drain the mail queue before user commands exit

2026-07-09 17:05:21 +00:00

config

fix(config): apply deprecated service.jwtsecret to service.secret

2026-07-26 15:59:40 +00:00

cron

…

db

fix(dump): parse dumped time strings so restore works on MySQL and MariaDB

2026-07-30 21:15:19 +02:00

doctor

…

e2etests

…

events

fix(notifications): use full user so notifications show display name

2026-06-18 20:57:05 +00:00

files

fix: GCS signing issue (#2920)

2026-07-02 17:38:37 +02:00

health

…

i18n

chore(i18n): update translations via Crowdin

2026-07-25 00:24:11 +00:00

initialize

feat(auth): add OpenID provider availability monitoring and retry logic (#3145)

2026-07-10 17:52:01 +02:00

license

fix(license): refuse redirects and use the SSRF-safe http client for checks

2026-07-28 17:26:12 +02:00

log

…

mail

fix(cli): drain the mail queue before user commands exit

2026-07-09 17:05:21 +00:00

metrics

feat(tasks): soft-delete tasks with permanent deletion after 30 days (#3119)

2026-07-07 11:38:33 +02:00

migration

fix(migration): repair kanban views without a bucket configuration mode

2026-08-04 01:09:10 +02:00

models

fix(security): reject link shares in Webhook.ReadAll

2026-08-04 13:40:11 +02:00

modules

fix(migration): abort import on unexpected task creation error

2026-08-02 16:21:50 +02:00

notifications

fix(notifications): require a persisted notification to declare its project

2026-07-29 07:58:17 +00:00

plugins

…

red

…

richtext

feat(richtext): add markdown-domain change detection

2026-06-29 08:12:35 +02:00

routes

feat(api/v2): add bulk task creation endpoint

2026-08-02 16:21:50 +02:00

swagger

[skip ci] Updated swagger docs

2026-07-29 08:45:06 +00:00

user

fix(auth): use configured bcrypt rounds everywhere

2026-07-28 08:43:26 +02:00

utils

fix(security): hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)

2026-07-19 18:59:34 +02:00

version

…

web

fix(web): stop logging the full auth object on permission denials

2026-07-29 07:58:17 +00:00

websocket

fix(notifications): check project access when reading notifications

2026-07-29 07:58:17 +00:00

webtests

feat(api/v2): add bulk task creation endpoint

2026-08-02 16:21:50 +02:00

yaegi_symbols

[skip ci] Updated yaegi symbols

2026-08-02 14:37:40 +00:00