WYGIWYH

0 Fork 0

mirror of https://github.com/eitchtee/WYGIWYH.git synced 2026-11-13 12:23:44 +01:00

Files

T

Herculino Trotta 1e486a608e fix(import): enforce object-level authorization on import profiles and runs

ImportProfile and ImportRun had no owner, and neither the web views nor the
REST viewsets filtered by the requesting user, so any authenticated user could
read, edit and delete every other user's import profiles and runs
(GHSA-q668-h56g-mfp4).

- ImportProfile is now a SharedObject, with share and take-ownership views
  like transaction rules; the global unique constraint on name is dropped.
- ImportRun is now an OwnedObject owned by the uploader, so runs made with a
  shared profile stay private to whoever ran them.
- Existing runs are backfilled with the owner of their imported
  transactions; existing profiles stay unowned and usable by everyone.

2026-10-24 13:26:37 -03:00

accounts

fix(sharing): enforce object-level authorization outside the rules app

2026-09-01 23:15:41 -03:00

api

fix(import): enforce object-level authorization on import profiles and runs

2026-10-24 13:26:37 -03:00

calendar_view

feat: add padding to the end of calendar

2024-10-30 00:27:39 -03:00

common

Merge pull request #569 from eitchtee/copilot/fix-code-scanning-alerts