projectsend

mirror of https://github.com/projectsend/projectsend.git synced 2026-10-04 21:43:57 +00:00

Files

T

ignacionelson db65731c3a Keep your own credentials behind your profile, and end tokens on a reset

Your own email address, password and second factor are changed from your
profile, which asks for your current password. The staff screen and the
API changed the first two with no password at all, and the API removed
the third on your own account without the confirmation the web asks
for. StaffAccounts::ownCredentialChanges is the one rule both now ask:
the staff screen refuses your own email or password with a validation
error and points to the profile, and the API answers 403, as it does for
removing your own second factor.

Changing somebody else's password is unchanged: that is what edit_users
and edit_clients mean, on the screen and over the API. It now also
revokes that account's API tokens. Browser sessions already ended with
the password hash; tokens did not.

GHSA-j5cp-r8pr-m5cr

2026-10-03 23:05:23 -03:00

Api

Let a client account expire on a date

2026-09-13 14:57:16 -03:00

Audit

Report actual file storage and temporary upload capacity separately

2026-09-20 17:58:08 +02:00

Clients

Keep an invitation inside the sender's own client scope

2026-09-18 03:35:14 -03:00

Comments

Stop serving a self-deleted account's files, and let them go at once