- Shipped
- September 23, 2026 at 10:02 AM UTC
- Author
- Kamo
- Commit
- 9bde243
Two org-scoping gaps the esig/imaging audit found, both in shared entry points other services build on: - **************** (the conversion service's dedup-skip-upload path) loaded the target ImgDat by id alone, with nothing comparing its org to the caller's. A member who obtained another org's imgDatId — no bytes required, just the id — could register it as a brand-new Img in their own org and then download another org's file through the ordinary imaging read path, which trusts the new Img's org rather than the dat's. Refused now with the same "ImgDat not found" the genuinely-missing case already throws, so a probe cannot tell "not yours" from "does not exist". - ESignTemplateRepository had findByImgId but no org-scoped counterpart, which is what let ESigService's initTemplate/getTemplateByImgId resolve another org's template from its imgId (fixed in esigservice). Added findByImgIdAndOrgId alongside the existing findByUidAndOrgId. Additive and backward compatible: registerExistingDocument's signature is unchanged, and the new repository method is a pure addition.