mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-20 02:23:20 +00:00
ignacionelson
67e9204654
#1685 fixed the dashboard rebuilding a log row by hand and dropping `origin` from it. One layer down, the same method was skipping something larger: it ran a bare ActivityLog::query(), so ActivityLogScope never applied. That scope exists for this exact case, and says so in its own docblock — `view_actions_log` is not the whole answer for a client-scoped staff member, because a log entry carries the subject's *name*. An unscoped log reads out the name of every file in the installation, and who touched it, to somebody who gets a 403 on the files themselves. Measured before the fix, one client-scoped viewer with the permission: /activity → [] /dashboard → Uploaded the file "Q3 delinquent accounts" Same person, same permission, opposite answers. The activity page and the download history both apply the scope; the dashboard was the one caller that did not, which is the same shape of gap #1685 was about. More reachable than it looks: the Client Manager system role ships with `view_actions_log`, so this is the default configuration rather than something an administrator has to build. Two tests: a scoped viewer sees only the entry about a file in their library, and an unscoped one still sees everything. transferSeries() is left alone on purpose. It is unscoped too, but it returns per-day counts with no names or subjects attached, which is a different exposure and arguably not one at all.