Jiayuan Zhang 96d88c9eef fix(server): validate workspace ownership for attachment uploads and queries ...

Prevent cross-workspace attachment injection (CRIT-3) by verifying
issue_id/comment_id belong to the caller's workspace before creating
attachment records. Add workspace_id filter to ListAttachmentsByCommentIDs
query (MED-3) to prevent cross-workspace attachment data leakage.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-11 04:08:33 +08:00

..

auth

…

cli

fix(comments): address code review feedback on pagination

2026-04-04 01:01:48 +08:00

daemon

feat(daemon): add minimum Claude Code version check (#625)

2026-04-10 16:09:56 +08:00

events

…

handler

fix(server): validate workspace ownership for attachment uploads and queries

2026-04-11 04:08:33 +08:00

logger

…

mention

feat(mentions): support @mentioning issues + server-side auto-expansion (#242)

2026-04-02 13:48:53 +08:00

middleware

fix(auth): extend JWT and CloudFront cookie expiration from 72h to 30 days

2026-04-06 21:48:31 +08:00

realtime

fix(realtime): add PAT auth support to WebSocket endpoint (#568) (#587)

2026-04-09 19:18:57 +08:00

sanitize

fix: sanitize markdown rendering in comments and shared renderers (#679)

2026-04-11 03:44:30 +08:00

service

fix(chat): add workspace scoping, error logging, and query cleanup

2026-04-09 17:18:14 +08:00

storage

fix(upload): SVG content-type fallback and Content-Disposition for non-media files

2026-04-09 15:33:02 +08:00

util

feat(mentions): support @mentioning issues + server-side auto-expansion (#242)

2026-04-02 13:48:53 +08:00