KamoCRM

Correctness, scale & PII hardening in LeadImportController

FixSecurityService
Shipped
2 ஜூலை, 2026 அன்று 2:00 AM UTC
Author
Kamo
Commit
b94ec36

- dedup via scoped LeadRepository query instead of findAll() over all tenants (was an OOM/DoS + cross-tenant exposure risk, re-run per 1000-row batch) - cap import at 100k rows and reject empty payloads - run transformations before the empty-skip so a defaultValue transform can fill blanks - honor transformation order; lenient boolean parse (1/Y/Yes/T/X); sanitize currency ($, commas) in loanAmount/propertyValue - stop double-counting duplicate rows as imported (processed = imported+duplicates+errors) - stop echoing raw exception text / stack traces (may embed lead PII) to client and logs

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free ForeverView Pricing