- Shipped
- September 23, 2026 at 8:37 AM UTC
- Author
- Kamo
- Commit
- f64f337
Two independent gaps in ImagingController: - /backfill-thumbnails selected candidates platform-wide (no organization predicate at all; the last-resort tier was a raw findAll filtered in memory), so any org's MANAGE_STORAGE admin could trigger a sweep that read and rewrote every OTHER tenant's document bytes too. Resolve the caller's own organization and select only from it, using the new org-scoped repository queries. The sweep itself was deliberately platform-wide by design; this service has no "god" signal to gate a genuinely cross-tenant run on instead, so scoping to the org is the fix. - historyChanges/historyDownloads resolved the Img via a raw imgRepository.findById, which checks existence only: no clearance ceiling, unlike every other read in this controller. A VIEW_DOCUMENTS member below a document's own access level could read its change history (dataOld included — the document's own prior field values) and its download trail, for a document they could never open directly. Resolve through **************** instead, the same call every other read here already uses, and handle the **************** it can throw.