- Shipped
- August 6, 2026 at 10:49 PM UTC
- Author
- Kamo
- Commit
- 24a039a
TWO THINGS, both of which stop MediaService main from shipping. 1. main does not compile. MediaController:1361 calls **************** which does not exist: the method on SupportTicketService is **************** Introduced by 90d46d2 ("fix(chat): announce a message once, when it is whole"), which is already on origin/main, so the remote has been red since. Called by the name that is actually defined at HEAD. A concurrent session is mid-refactor and its working tree renames the definition the other way; if that lands, this one line moves with it. 2. The SUBSCRIBE guard only guarded SUBSCRIBE. configureMessageBroker enables the SIMPLE broker on /topic and /queue, and the simple broker routes by destination without caring which command carried the frame — so a member who could not subscribe to **************** could still SEND to it, and the broker delivered the payload to the colleague who legitimately had subscribed. The forged body names the VICTIM, so both the client's "is this addressed to me?" check and every other identity check downstream pass, and any authenticated member could zero a colleague's compliance badge until the 60-second seed corrected it. allowClientSend takes NO identity argument on purpose. There is no session for which publishing to one of these destinations is right, not even the member who owns the topic: the payload is attacker-controlled, so an "unless it is your own" branch would just let a member silence their own outstanding packages. Every legitimate write comes from SimpMessagingTemplate inside this service, which never crosses the client inbound channel, and /app/** is untouched. The class is now StompDestinationAuthz — it decides on a destination, not on a SUBSCRIBE, and leaving the old name would have made the SEND rule look like an afterthought bolted onto a subscribe guard. Pre-existing exposure for the two org topics; this phase added the first per-member one. Verified in a detached worktree at HEAD plus these files only, because a concurrent session's in-flight support refactor makes an in-tree build meaningless: 56 tests, 0 failures.