kolaenteandkolaente cd9033184b fix(notifications): require a persisted notification to declare its project ...

The capability interface carrying a notification's project was optional, and
ProjectIDOf defaulted a missing implementation to 0 — which means
account-scoped, which means always visible. So a new project-scoped type whose
author forgot the method would have leaked task titles, project names and
comment bodies to users with no access to the project, with no compile error
and no test failure.

Register now takes a factory returning PersistedNotification, which requires
the method. Registering is what makes a notification persist, so a stored row
that cannot be permission-checked no longer compiles. The three account-scoped
types say so by returning 0 explicitly instead of by omission.

2026-07-29 07:58:17 +00:00

..

database.go

fix(notifications): check project access when reading notifications

2026-07-29 07:58:17 +00:00

db.go

…

events.go

feat(websocket): add notification event with XORM AfterInsert dispatch

2026-04-02 16:30:23 +00:00

logo.png

…

mail_render.go

fix(notifications): render Markdown in plain-text emails (#3219)

2026-07-18 14:39:32 +02:00

mail_test.go

fix(notifications): render Markdown in plain-text emails (#3219)

2026-07-18 14:39:32 +02:00

mail.go

…

main_test.go

feat(websocket): add notification event with XORM AfterInsert dispatch

2026-04-02 16:30:23 +00:00

markdown_escape_test.go

fix(notifications): render Markdown in plain-text emails (#3219)

2026-07-18 14:39:32 +02:00

markdown_escape.go

fix(notifications): escape markdown in user-controlled strings in email lines

2026-04-09 15:44:04 +00:00

notification_test.go

fix(notifications): require a persisted notification to declare its project

2026-07-29 07:58:17 +00:00

notification.go

fix(notifications): require a persisted notification to declare its project

2026-07-29 07:58:17 +00:00

notify_disabled_test.go

…

testing.go

…