forked from mirror/crumbs-original
Frederic CabassutandClaude Opus 4.6
b3d40999c9
- Add userId check to /api/notes/reorder (was completely unprotected) - Scope syncNoteTags by userId to prevent cross-user tag pollution - Verify attachmentId belongs to noteId in attachment operations (IDOR fix) - Remove DEFAULT 0 from userId columns so missing userId fails loudly - Update test helpers and test data to provide required userId Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
20 lines
349 B
JSON
20 lines
349 B
JSON
{
|
|
"version": "7",
|
|
"dialect": "sqlite",
|
|
"entries": [
|
|
{
|
|
"idx": 0,
|
|
"version": "6",
|
|
"when": 1773000424830,
|
|
"tag": "0000_wooden_vargas",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 1,
|
|
"version": "6",
|
|
"when": 1773016788899,
|
|
"tag": "0001_strange_lord_hawal",
|
|
"breakpoints": true
|
|
}
|
|
]
|
|
} |