- Shipped
- 3 Septemba 2026, 22:55 UTC
- Author
- Kamo
- Commit
- 0ddf84f
The signature footer went from one image to a row of them. The library is org-wide; the selection and its order are per scope, so an image uploaded while editing one signature is offered under all three and printed only where it is ticked. Two surfaces with deliberately different auth, which is why they do not share a path. /api/email/signature-badges needs a session — it is the settings screen. **************** does not and cannot: it is what a RECIPIENT's mail client fetches while rendering a message, from a machine that has never heard of Kamo. Only that second prefix is exempted in OTKPreAuthFilter, so the exemption cannot widen into 'anyone may edit an organization's badges'. It is addressed by random UUIDv4, cached immutably, and served under a CSP sandbox so an SVG opened directly cannot be a document carrying script. A delete is never one row. A badge removed from the library while COMPANY still lists it leaves that scope rendering an img at a URL that now 404s — a broken glyph in the footer of every message it signs, which nothing reports and which the member who deleted it never sees, because they are looking at the scope they deleted it from. So the same transaction strips the id from every template. ImageHeaderReader is the server's own read of the upload. ConversionService resizes before this point, but 'the client already did it' describes every request except the one worth refusing — and every library that would answer 'how tall is this' decodes the whole raster to do it, so a 10 MB PNG declaring 30000x30000 would allocate gigabytes in a pod sized for mail. These bytes are parsed, never decoded.