fix(security): harden authorization and resource limits - #3688

Merged

kolaente merged 22 commits into

mainfrom

fix-draft-security-advisories

Aug 31, 2026

Commits on Aug 30, 2026

fix(migration): serialize imports per user
kolaente
committed
4008737
fix(tasks): hide assignee email addresses
kolaente
committed
0855e13
fix(tasks): authorize both sides of relation deletion
kolaente
committed
3234f6e
fix(users): reject link shares from user listings
kolaente
committed
10cf863
fix(sharing): restrict link share hash reads
kolaente
committed
92ba159
fix(caldav): authorize task relations
kolaente
committed
107a634
fix(tasks): restrict subtask expansion by access
kolaente
committed
b5e3291
fix(tasks): require access for favorites
kolaente
committed
9048981
fix(sharing): restrict team attachment visibility
kolaente
committed
ed28b42
fix(tasks): validate position target views
kolaente
committed
4dc60fd
fix(auth): hide enabled totp secrets
kolaente
committed
dbd092e
fix(api): enforce token scopes for task expansions
kolaente
committed
51e4a58
fix(filters): bound expression complexity
kolaente
committed
527fbdc
fix(images): bound decode and resize dimensions
kolaente
committed
416d2c5
fix(routes): rate limit basic auth failures
kolaente
committed
5650b49
fix(migration): cap csv rows while decoding
kolaente
committed
82c6832
fix(migration): bound planka import resources
kolaente
committed
6853279
fix(migration): bound vikunja file imports
kolaente
committed
c555da3
chore: regenerate yaegi symbols
kolaente
committed
19f7b51

Commits on Aug 31, 2026

test(e2e): make team owner a fixture member
kolaente
committed
4e67e84
test(migration): handle database id sequences
kolaente
committed
1ec8a75
fix(migration): reload conflicting claims after rollback
kolaente
committed
d55cfbc