- Shipped
- 15 ஆகஸ்ட், 2026 அன்று 6:25 AM UTC
- Author
- Kamo
- Commit
- df070d3
Bulk email was half-enforced and the halves were in different services. **************** in SecurityService has gated recipient resolution on MANAGE_BULK_EMAIL since it shipped — sending a blast is the dangerous half and somebody knew it. The campaigns themselves were not gated at all: CampaignController and BulkProviderController checked the session for an org and nothing else, so any member could list, create, duplicate, schedule, send, pause or cancel a campaign, and read or overwrite the bulk-email provider credentials. Reads take VIEW_BULK_EMAIL and the fifteen writes take MANAGE_BULK_EMAIL. Provider credentials and the live test-send take the bulk-email rights rather than MANAGE_EMAIL_SETTINGS, because what they configure is bulk email specifically. Both helpers fail closed and let god through, matching the SecurityService half so the two ends of one feature cannot disagree about who may send.