- Shipped
- September 23, 2026 at 1:33 PM UTC
- Author
- Kamo
- Commit
- 35776fa
19505faf stopped updateGiftCard from reading currentBalance so a member of one org could not rewrite another org's card by uid. The org-scoped lookup already closes that; dropping the field as well left the Discounts tab's gift-card dialog — which sends the balance on every save — silently ignoring the edit, with no right anywhere that could make it work. The balance is set again, on the caller's own card only, and the right is enforced where it is known: securityservice's CommerceMarketController now takes MANAGE_PRICING for every gift-card write (and VIEW_PRICING to list them), the same rights as everything else on that tab. There are no gift cards in production yet, so nothing changes for existing data.