KamoCRM

Scope the opportunities read, and give the relay client timeouts

FixSecurityService
Shipped
7 ஆகஸ்ட், 2026 அன்று 2:49 AM UTC
Author
Kamo
Commit
a8bb666

/me/opportunities called reservationRepository.findAll() and filtered org and member in Java. That pulls every reservation on the platform — every tenant's — into one heap, on a page any member can refresh at will, and it gets slower for everybody as any single organization grows. Replaced with an org-and-agent-scoped finder in the repository. CommissionServiceClient used a bare RestTemplate, which has NO connect or read timeout. A downstream that accepts the connection and then stalls would hold the request thread indefinitely — and SecurityService issues every session on the platform from that pool. Read timeout sits above the downstream's own Stripe budget so a slow-but-working payout is not cut off by the hop in front of it.

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free ForeverView Pricing