lebaudantoine 5ba1657e00 🧪(backend) add test exposing rooms permission flaw in external API ...

Add a failing test demonstrating that a user can retrieve a room they
do not have access to when the room UUID is known.

This highlights an improper object-level permission verification in the
external API. While exploitation requires obtaining the target room
UUID, this still represents a security issue (BOLA / IDOR class
vulnerability) and must be fixed.

The test documents the expected behavior and will pass once proper
access filtering or permission checks are enforced.

2026-02-09 12:16:12 +01:00

..

api

✨(frontend) allow starting both a recording and a transcription

2026-01-04 20:22:15 +01:00

authentication

🐛(auth) fix LiveKit token authentication field mismatch

2025-10-20 04:57:02 +02:00

external_api

♻️(backend) refactor ApplicationViewSet to use a basic ViewSet

2026-02-03 16:22:06 +01:00

migrations

✨(backend) add a flexible JSON field to store recording options

2026-01-04 20:22:15 +01:00

recording

♻️(backend) refactor backend recording state management

2026-01-05 00:14:00 +01:00

services

🐛(backend) fix ignore recording webhook events

2026-01-05 13:34:55 +01:00

static/images

✨(project) Django boilerplate

2024-06-25 12:48:54 +02:00

templatetags

✨(project) Django boilerplate

2024-06-25 12:48:54 +02:00

tests

🧪(backend) add test exposing rooms permission flaw in external API

2026-02-09 12:16:12 +01:00

__init__.py

✨(project) Django boilerplate

2024-06-25 12:48:54 +02:00

admin.py

⚡️(admin) improve recording access select component performance

2026-02-05 19:16:02 +01:00

enums.py

✨(backend) add authenticated recording file access method

2025-04-16 12:13:42 +02:00

factories.py

✨(backend) add application model with secure secret handling

2025-10-06 19:34:24 +02:00

fields.py

✨(backend) add application model with secure secret handling

2025-10-06 19:34:24 +02:00

models.py

✨(backend) add a flexible JSON field to store recording options

2026-01-04 20:22:15 +01:00

urls.py

🔧(backend) add Django setting to disable external API endpoints

2025-10-06 19:34:24 +02:00

utils.py

🚧(backend) update recording metadata alongside recording state changes

2026-01-04 20:22:15 +01:00