KamoCRM

Mungu bypass inafuata R7 - GD peke yake hupita haki ya mwenye nyumba katika jukwaa org tu

FixSecurityService
Shipped
15 Novemba 2026, 00:27 UTC
Author
Kamo
Commit
1450bd3

Mmiliki 2026-10-18 (IoT bwana §10 R7): wazi, unexpired mungu-mode dirisha hupita mwenye nyumba-haki kuangalia mahali popote; GD uwezekano peke yake hupita yao tu wakati mkutano wa shirika ni jukwaa org (orgs.is_top_level). ya awali kujitoa alifanya kila mlango dirisha-pekee, ambayo kulazimisha wafanyakazi jukwaa kuvunja kioo ndani ya jukwaa org yenyewe. **************** inatekeleza (kanuni sawa kama **************** na MediaService AuthHelper) jukwaa org id anakuja kutoka PlatformOrgIdCache: kutatuliwa mara moja kupitia findFirstByIsTopLevelTrue, cached 6h, id nzuri ya mwisho juu ya kushindwa, kamwe swali kwa kuangalia; haijulikani = si jukwaa org (kushindwa kufungwa). Mfumo User vikao (SUDO_MEMBER_ID) kukaa dirisha-pekee. wote wapangaji-haki milango kubadilishwa mwisho kujitolea sasa kutumia, ikiwa ni pamoja na ClinicalRightsGuard (hakuna PHI-kipekee Mungu sheria ipo) na Impersonation same-org mlango. Makusudi kuvunja-kioo-pekee milango kuweka isGodModeActive: akaunti kufuta, org kuharibu / branding, PHI ukaguzi kusoma, PHI mpaka, ChildOrgCreation, MemberSecurityController, ThemeBackground, DevMachine, Watakatifu wa Agano la Kale Orodha ya Watakatifu Wafransisko

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free ForeverView Pricing