Ole-Morten Duesund
0e5bf0a035
The sort endpoint validated existence with a bare `SELECT 1 FROM activities WHERE id = ?`, ignoring visibility. A logged-in attacker could PATCH /sort with any UUID and distinguish "private id exists, owned by someone else" (200) from "id doesn't exist" (404), letting them enumerate private activity ids. Apply the same visibility filter as GET /:id, toggleDone, and toggleFiling: private requires owner; friends requires mutual-friend + no block in either direction; hidden rows return 404, not 403. Regression test added in tests/activities.test.ts. Surfaced by /audit security (HIGH severity). |
||
|---|---|---|
| .. | ||
| activities.test.ts | ||
| admin.test.ts | ||
| auth.test.ts | ||
| crypto.test.ts | ||
| engagement.test.ts | ||
| friends.test.ts | ||
| helpers.ts | ||
| profile.test.ts | ||
| social.test.ts | ||