Enforce document/binder collection scope in addItem

FixDocsService
Ya
6 Agosti 2026, 07:57 UTC
Mwandishi
Kamo
Ahadi ya
8db7fc5

BinderService.addItem checked read access and refused VAULT/LOAN documents, but never compared the document's own collection to the binder's, so a hand-crafted request could still cross-file a document from another collection into a binder - the UI-only fix left the API open.

Mabadiliko yote

Je, unaona nini kuhusu usafiri?

Kila moja ya hizi updates ardhi katika nafasi yako ya kazi moja kwa moja. Kuanza bure na kuangalia kukua wiki baada ya wiki.

Kuwa Huru MileleMtazamo wa bei