admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4727 - record: F10 moved to case 4736

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-26 10:43:35 -07:00
parent 72a64159c4
commit b9035b93b0
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
devdocs/modernization/SECURITY-REVIEW.md
View File

@@ -222,7 +222,7 @@ take the next free number; a fixed or accepted finding keeps its ID and changes
| F7 | Low | **fixed in case 4725** | Password change or reset does not end existing sessions, and makes the download key non-expiring |
| F8 | Low | **fixed in case 4725** | Latest-token check skipped for any URL ending in `/auth` or `notify/hello` |
| F4 | Low | **fixed in cases 4712 and 4723** | Any logged-in user can send an in-app notification to any user |
| F10 | Low | **accepted** (John, 2026-10-24; legal check to do) | Anyone can record acceptance of the licence agreement (`license/lc`) |
| F10 | Low | **later case 4736** (not 8.3.0; accepted as is for 8.3.0, legal check to do) | Anyone can record acceptance of the licence agreement (`license/lc`) |
| F11 | Low | **fixed in case 4727** | API root page shows licensee, version, licence terms (and DB ID when unlicensed) to anyone |
| F12 | Low | **later case** (not 8.3.0) | Password hashing: PBKDF2-SHA512 with 10,000 iterations |
| F25 | Low | **fixed in case 4727** (upload before rights check accepted) | Attachment and export gaps: upload stored before the rights check, "attached by" can be set to anyone, exports not tied to their user |
@@ -350,6 +350,7 @@ first SuperUser login; at least warn in the UI and the manual.
"SuperUser only", but the route is anonymous. Legal rather than technical: the consent record
does not prove who accepted. Fix: require SuperUser.
**John, 2026-10-24: accepted as is** (login is refused until consent is given, so consent can't require a login; requiring credentials in the request would need a client change). To be checked from a legal standpoint.
**John, 2026-10-26: moved out of case 4727 into case 4736, after 8.3.0.**
### F11 Anonymous API root page discloses licence details (pass 2)
@@ -891,8 +892,8 @@ by a customer contact. Pass 8: confirmed from code (`NotifyController.SendNotify
John's cases for the findings (created 2026-10-24; full list in `NET10-PORT.md`, "Release 8.3.0
cases"): 4710 (F5, F41), 4711 (F1), 4712 (F13 to F17), 4715 (F21), 4716 (F18), 4717 (F26),
4718 (F19, F24), 4719 (F20), 4720 (F27), 4721 (F33), 4722 (F34), 4723 (F3, F4), 4724 (F30, F31),
4725 (F7, F8, F9), 4726 (F6), 4579 (F2), 4713 (F28), 4727 (F10, F11, F12, F22, F23, F25, F29, F35, F36, F38, and
the AyaNova half of F39), Sockeye 4681 (F40). The Sockeye half of F39 (repeatable licence fetch) moved to a later case: AyaNova reinstalls and logs any key it fetches without comparing it with the installed one (trial servers with data would log an E1020 error on every fetch), and deployed older servers cannot be changed, so it needs an AyaNova-side change plus a request flag that Sockeye honours. Not in 8.3.0: F32, F42 (John's later cases); F37 accepted. When a
4725 (F7, F8, F9), 4726 (F6), 4579 (F2), 4713 (F28), 4727 (F11, F12, F22, F23, F25, F29, F35, F36, F38, and
the AyaNova half of F39), Sockeye 4681 (F40). The Sockeye half of F39 (repeatable licence fetch) moved to a later case: AyaNova reinstalls and logs any key it fetches without comparing it with the installed one (trial servers with data would log an E1020 error on every fetch), and deployed older servers cannot be changed, so it needs an AyaNova-side change plus a request flag that Sockeye honours. Not in 8.3.0: F10 (case 4736), F32, F42 (John's later cases); F37 accepted. When a
case is done, its findings' status becomes *fixed in case NNNN*.
## Customer contact route allowlist (implemented in case 4712)