projectsend

mirror of https://github.com/projectsend/projectsend.git synced 2026-10-05 12:54:33 +00:00

Files

T

ignacionelson 2a6f77a02a Keep a scoped staff member's invitation list and revoke inside their reach

A staff member limited to some clients may only invite into the groups
those clients are in, but the invitation list showed every invitation
in the installation, names and addresses included, and revoking took
back any pending one. Both now ask InvitationController::visibleTo(): the
invitations they sent, and those into a group within their reach. Out of
reach reads as 404. Unscoped staff are unaffected.

GHSA-phv7-54fm-qh4r

2026-10-05 01:14:10 -03:00

Console

Let a client account expire on a date

2026-09-13 14:57:16 -03:00

Http

Keep a scoped staff member's invitation list and revoke inside their reach

2026-10-05 01:14:10 -03:00

Models

Stop a typed-in storage quota from 500ing when a client is created

2026-09-12 21:16:49 -03:00

Notifications

Invite a client to register instead of handing them a password (#1780 )