kolaente e025209e3c fix(security): validate link share JWTs against DB on every request ... Previously GetLinkShareFromClaims built a *LinkSharing entirely from JWT claims with no DB interaction, so deleted shares and permission downgrades took up to 72h (the JWT TTL) to take effect. The permission and sharedByID claims were trusted blindly. GetLinkShareFromClaims now takes an *xorm.Session, looks up the share via GetLinkShareByID, verifies the hash claim against the DB row, and returns ErrLinkShareTokenInvalid when the row is missing or the hash mismatches. The permission and sharedByID claims are discarded; the DB row is authoritative. GetAuthFromClaims opens a read session for the link-share branch, mirroring the existing API-token branch. Token creation and the JWT format are unchanged, so already-issued tokens keep working except when the underlying share has been deleted or its hash no longer matches. Fixes GHSA-96q5-xm3p-7m84 / CVE-2026-35594.		2026-04-09 15:38:07 +00:00
..
auth	fix(security): validate link share JWTs against DB on every request	2026-04-09 15:38:07 +00:00
avatar	fix: add timeouts to Gravatar, Unsplash, and SSRF-safe HTTP clients	2026-04-09 07:31:08 +00:00
background	fix: add timeouts to Gravatar, Unsplash, and SSRF-safe HTTP clients	2026-04-09 07:31:08 +00:00
dump	chore(lint): suppress known gosec false positives	2026-03-23 16:23:15 +01:00
keyvalue	feat: add generic RememberValue[T] for type-safe keyvalue caching	2026-04-08 08:56:22 +00:00
migration	feat(migration): flatten project hierarchy for single-project imports	2026-04-07 15:20:06 +00:00