Thanks for the feature work. I found one should-fix issue around user-information exposure on the new assigned-tickets endpoint. Please address the inline comment before merge.
Thanks for the feature work. I found one should-fix issue around user-information exposure on the new assigned-tickets endpoint. Please address the inline comment before merge.
meta.assignee is returned for any authenticated application key, even when the caller has no visible projects. That enables account/email enumeration by iterating /api/users/{id}/assigned-tickets. Please enforce a visibility/permission check before returning assignee metadata (or avoid returning assignee details when no shared visibility exists).
`meta.assignee` is returned for any authenticated application key, even when the caller has no visible projects. That enables account/email enumeration by iterating `/api/users/{id}/assigned-tickets`. Please enforce a visibility/permission check before returning assignee metadata (or avoid returning assignee details when no shared visibility exists).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Koda
Thanks for the feature work. I found one should-fix issue around user-information exposure on the new assigned-tickets endpoint. Please address the inline comment before merge.
@@ -0,0 +21,4 @@return response()->json(['data' => $this->listAssignedTicketsByVisibleProject->handle($viewer, $user),'meta' => ['assignee' => UserResource::make($user)->resolve(),meta.assigneeis returned for any authenticated application key, even when the caller has no visible projects. That enables account/email enumeration by iterating/api/users/{id}/assigned-tickets. Please enforce a visibility/permission check before returning assignee metadata (or avoid returning assignee details when no shared visibility exists).Here is the improvements PR: OpenSource/KanbanGit#56
Here is the improvements PR: OpenSource/KanbanGit#56