sandrodachandClaude Opus 5.5 3900c6104e fix(security): list items need write access to their list (FLAW-27) ...

Creating, checking, editing, deleting, reordering and clearing list
items did not check the list at all: any logged-in user with a list or
item ID could change it, viewers of shared lists as well. All item
endpoints and converting a thought into a list item now require owner
or editor rights and that the item belongs to the list (404 without
access, 403 for viewers).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-29 14:28:39 +01:00

..

alarm_test.go

feat(tasks): due dates with optional time; alarms at the right moment

2026-10-29 07:48:37 +01:00

alarms.go

fix(alarms): give up after three runs without delivery (FLAW-12)

2026-10-29 12:22:13 +01:00

clientip.go

feat(auth): lock logins after repeated failures, trust proxies explicitly (FLAW-09)

2026-10-29 14:26:02 +01:00

demo_test.go

feat(demo): reset the demo instance every 20 minutes with a countdown

2026-10-29 14:22:06 +01:00

demo.go

feat(demo): reset the demo instance every 20 minutes with a countdown

2026-10-29 14:22:06 +01:00

docsync_test.go

feat(notes): compact the operation log and purge old tombstones

2026-10-28 15:08:13 +01:00

docsync.go

feat(notes): compact the operation log and purge old tombstones

2026-10-28 15:08:13 +01:00

handlers_account.go

refactor: split sqlite.go and server.go by domain (FLAW-20)

2026-10-29 08:14:33 +01:00

handlers_admin.go

feat(auth): lock logins after repeated failures, trust proxies explicitly (FLAW-09)

2026-10-29 14:26:02 +01:00

handlers_auth.go

feat(auth): lock logins after repeated failures, trust proxies explicitly (FLAW-09)

2026-10-29 14:26:02 +01:00

handlers_documents.go

refactor: split sqlite.go and server.go by domain (FLAW-20)

2026-10-29 08:14:33 +01:00

handlers_folders.go

refactor: split sqlite.go and server.go by domain (FLAW-20)

2026-10-29 08:14:33 +01:00

handlers_integrations.go

refactor: split sqlite.go and server.go by domain (FLAW-20)

2026-10-29 08:14:33 +01:00

handlers_lists.go

fix(security): list items need write access to their list (FLAW-27)

2026-10-29 14:28:39 +01:00

handlers_tasklists.go

refactor: split sqlite.go and server.go by domain (FLAW-20)

2026-10-29 08:14:33 +01:00

handlers_teams.go

refactor: split sqlite.go and server.go by domain (FLAW-20)

2026-10-29 08:14:33 +01:00

handlers_thoughts.go

refactor: split sqlite.go and server.go by domain (FLAW-20)

2026-10-29 08:14:33 +01:00

loginguard_test.go

feat(auth): lock logins after repeated failures, trust proxies explicitly (FLAW-09)

2026-10-29 14:26:02 +01:00

loginguard.go

feat(auth): lock logins after repeated failures, trust proxies explicitly (FLAW-09)

2026-10-29 14:26:02 +01:00

mail_test.go

fix(smtp): AUTH LOGIN fallback when PLAIN is refused

2026-10-29 00:09:27 +01:00

mail.go

fix(smtp): AUTH LOGIN fallback when PLAIN is refused

2026-10-29 00:09:27 +01:00

netguard_test.go

fix(security): SSRF protection for alarm webhooks (FLAW-05)

2026-10-29 07:37:39 +01:00

netguard.go

fix(security): SSRF protection for alarm webhooks (FLAW-05)

2026-10-29 07:37:39 +01:00

password_reset.go

feat(auth): lock logins after repeated failures, trust proxies explicitly (FLAW-09)

2026-10-29 14:26:02 +01:00

realtime_test.go

feat(notes): push, long polling and fallback detection for note sync

2026-10-28 14:10:29 +01:00

realtime.go

refactor: split sqlite.go and server.go by domain (FLAW-20)

2026-10-29 08:14:33 +01:00

server_test.go

fix(auth): new passwords need at least 8 characters (FLAW-09)

2026-10-29 12:20:46 +01:00

server.go

feat(auth): lock logins after repeated failures, trust proxies explicitly (FLAW-09)

2026-10-29 14:26:02 +01:00