Skip to content

security(reports): authorize the apps a report targets, on every path that uses them #7864

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ar2rsawseen wants to merge 7 commits into
base: master
Choose a base branch
from
+954 −97
Open

security(reports): authorize the apps a report targets, on every path that uses them #7864

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6a5509a
fix(reports): authorize non-core report targets on create and update
ar2rsawseen Jul 29, 2026
9c5bf84
test(reports): cover authorization of non-core report targets
ar2rsawseen Jul 29, 2026
5fb1a6e
test(reports): cover a dashboards report for a shared dashboard
ar2rsawseen Jul 30, 2026
247b2c7
security(reports): authorize the apps a report will actually have
ar2rsawseen Jul 31, 2026
86e5062
security(reports): authorize a report's apps when enabling, sending a…
ar2rsawseen Aug 1, 2026
e4517fd
Merge branch 'master' into security/reports-noncore-authorization
ar2rsawseen Aug 3, 2026
9ef402f
security(reports): stop sending when the report owner no longer exists
ar2rsawseen Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
## Version 25.03.xx
Fixes:
- [reports] Non-core reports, such as dashboard reports, now authorize the object they target on create and update
- [hooks] Internal event hooks are validated on save: an unknown event type is rejected, and an event that names a cohort, hook or alert must name one belonging to the hook's own apps
- [events] Fix sum chart tooltip displaying the raw floating-point value instead of a rounded number
- [events] Fixed event descriptions (and custom names / count-sum-dur labels) not showing on the Events page for events whose key contains special characters (`.`, `$`, `\`, `&`, `<`, `>`, `"`, `'`)
Expand All @@ -8,6 +9,7 @@ Enterprise Fixes:
- [data-manager] Fixed editing an event whose key contains `&` creating undeletable duplicate rows in the events table

Security Fixes:
- [reports] Enabling, sending or rendering a report now checks that the apps it covers are still readable by the caller, and scheduled reports stop being emailed once the member they are scheduled as loses access to those apps
- [hooks] Internal event hooks are now scoped to the apps the hook belongs to: app creation is a global-admin-only event, and remote-config, cohort, alert and hook-chaining events are only delivered when the event's app is one the hook is scoped to
- [compliance-hub] The consents table now returns a fixed set of fields; a projection supplied on the request is no longer used to widen the response beyond the consent columns
- [dashboards] Widgets are no longer copied when the copying user has no access to the apps they reference, and widget app ids are validated on widget create and update
Expand Down
Loading
Loading