Step 4 of 4712 (security review F15). Pick lists checked only the Select role,
which customer contacts have for most types, and took the columns from the
request, so a contact could list every customer with phones and emails. For
contacts now: the customer list holds only their own customer (head office
contacts: their head office's customers); the unit list only their own
customer's units (head office contacts: the chosen customer, which must be
theirs; none until one is chosen); unit models as before; any other list 403.
pick-list/single names only those records. New CustomerPickList variant for a
single customer. Staff unchanged.
Checked: the contact's customer list went from 72 customers to its own one;
units only its own; vendors and users 403.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Step 3 of 4712 (security review F14). The Customer role has change rights on
service requests and nothing checked whose they were. For customer contacts:
another customer's request is not found (read, update, delete); creating or
moving a request to a customer the contact does not own is refused (403); a
contact's request is always requested by that contact. unit/customerunit adds
units only to the contact's own customer (or one of its head office's).
Checked: another customer's request 404 (was 200), create for another customer
403, own request created and deleted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Step 2 of 4712 (security review F13). The customer work-order rights checked
only tag-based feature switches, never which customer a work order belongs to.
New UserBiz.CustomerContactOwnsCustomerAsync (own customer, or for a head
office contact a customer of its head office), used by:
- workorder/customer/{id}: another customer's work order is not found (404);
- customer work order report (-100): exactly one work order, which must be the
contact's (the renderer used every id it was given);
- work order attachment list and download for contacts; other attachment types
are refused to contacts (the customer screens show them only on work orders).
Checked: other customer's work order 404 (was 200); report on another's or on
two work orders not found; own customer report still accepted (202).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
report/download and export/download (any download key), the log-file routes and
backup download built a path from the file name in the URL with Path.Combine
and no check, so on Windows a name with a folder part or an absolute path could
reach files outside the folder (security review F21). New helper
FileUtil.FullPathInFolderOrNull accepts only a bare file name that resolves
directly inside the folder; TemporaryFileExists and BackupFileExists use it
(the download routes already call them first), and so do both log routes.
A refused name gets the same 404 as a missing file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
report/upload and translation/upload had no role check, so any login, customer
contacts included, could import a report template (whose JavaScript runs in the
server's browser at render time) or a translation (security review F19, F24).
Both now require the same right as creating one, checked before the upload is
read. The import screens are already limited to those roles.
Checked locally: customer contact and Service 403, BizAdmin 202.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The 2FA step matched the user by temp token alone, and the token was left
empty after a successful 2FA login (null right after turning 2FA on), so an
empty or missing token skipped the password step (security review F5).
Now: an empty or missing temp token is refused before the lookup; the token is
cleared to null after success; after 5 wrong codes the token is cleared, so the
password must be entered again (counted in memory per user).
Changelog: general security notice for self-hosted upgrades, and the one
behaviour change users can see. SECURITY-REVIEW.md: F5 fixed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
