- Shipped
- 8 ஜூலை, 2026 அன்று 10:32 PM UTC
- Author
- Kamo
- Commit
- 0d782a8
SECURITY: **************** ran 'SELECT email FROM virtual_users' (and **************** 'SELECT name FROM virtual_domains') with no org scoping, so mailbox/domain sync imported EVERY org's KamoMail mailboxes into the caller's org — one org could see another org's private mailboxes (Option One had all of kamocrm's imported). Scope by org_domains (the DNS-verified ownership boundary — the one source the email sync itself can't pollute): listMailboxes filters out mailboxes on domains the org doesn't own (hides already-leaked rows immediately); syncMailboxes imports only own-domain mailboxes and prunes foreign rows from prior unscoped syncs; EmailDomainService.syncDomains no longer imports shared-server domains the org never registered. Adds **************** + isolation tests. Also: saveProviderConfig resets status to PENDING_SETUP when switching to an OAuth provider so a persisted selection isn't shown as falsely connected before the OAuth callback completes.