Erik Michelson d38b99887d fix(revisions): always check noteId when fetching a revision ...

This fixes a reported security vulnerability where one use could
retrieve revisions of another note where they don't have access
to. This was possible, because the URL included both the note alias
and the revision UUID, the backend then checked the user's permissions
for the note alias but fetched and returned the revision by its UUID
without checking whether the revision belongs to that note.

Credits for finding and reporting this vulnerability to:
- The Raw (https://github.com/therawdev)
- Vishal (https://github.com/shukla304)

Signed-off-by: Erik Michelson <github@erik.michelson.eu>

2026-05-19 20:32:18 +02:00

..

docker

chore(deps): update node.js to v24.14.0

2026-03-04 00:18:00 +01:00

public

fix(repository): Move backend code into subdirectory

2022-10-30 22:46:42 +01:00

src

fix(revisions): always check noteId when fetching a revision

2026-05-19 20:32:18 +02:00

test

test(backend/e2e): fix /private/explore/pin/:noteAlias forbidden alias test

2026-05-13 23:59:37 +02:00

.editorconfig

fix(repository): Move backend code into subdirectory

2022-10-30 22:46:42 +01:00

.env

fix: add .env file symlinks

2023-04-13 10:39:17 +02:00

.gitignore

fix(repository): Move backend code into subdirectory

2022-10-30 22:46:42 +01:00

.oxfmtrc.json

chore(format): reformat using oxfmt

2026-01-14 19:46:27 +01:00

.oxfmtrc.json.license

chore(format): reformat using oxfmt

2026-01-14 19:46:27 +01:00

.oxlintrc.json

fix(lint): avoid incompatible TypeScript rule

2026-05-09 13:05:59 +02:00

.oxlintrc.json.license

chore(lint): replace ESLint with OXLint for performance

2026-01-14 19:46:27 +01:00

build.sh

fix(docker): remove bash-dependencies from build script

2026-01-12 09:46:41 +01:00

CHANGELOG.md

refactor: remove dropbox, facebook & twitter login

2023-10-07 13:28:37 +02:00

docker-compose.auth.yml

chore: add docker compose for auth provider

2026-01-14 21:22:11 +01:00

docker-compose.database.yml

chore(deps): update postgres docker tag to v16.13

2026-03-04 00:23:26 +01:00

jest-e2e.json

chore(tests): performance improvements for backend tests

2026-04-15 19:34:53 +02:00

jest-e2e.json.license

fix(repository): Move backend code into subdirectory

2022-10-30 22:46:42 +01:00

jest.tsconfig.json

fix(tests): make jest tests run again

2026-05-09 13:05:59 +02:00

jest.tsconfig.json.license

fix(tests): make jest tests run again

2026-05-09 13:05:59 +02:00

knexfile.ts

fix(knex): remove sqlite error message

2025-11-06 00:55:21 +01:00

nest-cli.json

fix(repository): Move backend code into subdirectory

2022-10-30 22:46:42 +01:00

nest-cli.json.license

fix(repository): Move backend code into subdirectory

2022-10-30 22:46:42 +01:00

oxlint-local-rules.js

chore(lint): replace ESLint with OXLint for performance

2026-01-14 19:46:27 +01:00

package.json

fix(tests): make jest tests run again

2026-05-09 13:05:59 +02:00

package.json.license

fix(repository): Move backend code into subdirectory

2022-10-30 22:46:42 +01:00

tsconfig.build.json

fix(repository): Move backend code into subdirectory

2022-10-30 22:46:42 +01:00

tsconfig.build.json.license

fix(repository): Move backend code into subdirectory

2022-10-30 22:46:42 +01:00

tsconfig.json

fix(tests): make jest tests run again

2026-05-09 13:05:59 +02:00

tsconfig.json.license

fix(repository): Move backend code into subdirectory

2022-10-30 22:46:42 +01:00