Frederic CabassutandClaude Opus 4.6 d5a079a4bd fix: enforce note ownership across all API endpoints ...

- Add userId check to /api/notes/reorder (was completely unprotected)
- Scope syncNoteTags by userId to prevent cross-user tag pollution
- Verify attachmentId belongs to noteId in attachment operations (IDOR fix)
- Remove DEFAULT 0 from userId columns so missing userId fails loudly
- Update test helpers and test data to provide required userId

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-09 01:50:12 +01:00

..

meta

fix: enforce note ownership across all API endpoints

2026-03-09 01:50:12 +01:00

0000_wooden_vargas.sql

feat: add image attachment backend — batch fetch, API responses, optimization, thumbnails

2026-03-08 22:37:50 +01:00

0001_strange_lord_hawal.sql

fix: enforce note ownership across all API endpoints

2026-03-09 01:50:12 +01:00