bd4494abac
case 4712 - customer contacts reach only their own customer's work orders
...
Step 2 of 4712 (security review F13). The customer work-order rights checked
only tag-based feature switches, never which customer a work order belongs to.
New UserBiz.CustomerContactOwnsCustomerAsync (own customer, or for a head
office contact a customer of its head office), used by:
- workorder/customer/{id}: another customer's work order is not found (404);
- customer work order report (-100): exactly one work order, which must be the
contact's (the renderer used every id it was given);
- work order attachment list and download for contacts; other attachment types
are refused to contacts (the customer screens show them only on work orders).
Checked: other customer's work order 404 (was 200); report on another's or on
two work orders not found; own customer report still accepted (202).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-24 13:52:31 -07:00
87a4946500
case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this
2024-05-09 22:56:53 +00:00
7039b367bd
2023-02-22 23:57:24 +00:00
3363a5ae43
2022-03-11 16:08:00 +00:00
d7d8e9340c
2022-03-11 15:17:01 +00:00
7a246dfdcf
2022-03-11 00:39:19 +00:00
794991d617
case 4141
2022-03-11 00:22:02 +00:00
09972da7e4
2022-03-10 23:40:25 +00:00
0784313e6d
2022-03-10 23:32:33 +00:00
fab6212113
2021-11-18 20:58:17 +00:00
137cf4856e
2021-11-18 20:56:31 +00:00
d03ffcc50e
utc date issue / npgsql 6 issue fixed in AttachmentController
2021-10-16 00:43:00 +00:00
a33bf0ed30
2021-08-30 20:20:56 +00:00
23cc77d38c
2021-04-01 14:18:34 +00:00
dde1b8bb8c
rename all variants of naming that hold an AyaType value to "aType" (parameter) / "AType" (not parameter) everywhere front and back; "ayType", "objectType", "oType" all are used in various areas
2021-03-23 17:06:05 +00:00
89c411bc28
2021-03-16 17:14:35 +00:00
9236c91ff6
2021-03-16 15:15:13 +00:00
3c5585b2ec
2020-12-22 20:33:48 +00:00
ada2ade15b
2020-12-10 21:53:19 +00:00
61cc48530a
Batch is the new Bulk
2020-12-10 19:29:00 +00:00
1fc4247149
Bulk is out Batch is in
2020-12-10 18:27:31 +00:00
b18a87bdf5
2020-10-26 20:42:16 +00:00
b9f35d9d79
2020-09-07 15:50:24 +00:00
7ba1f47242
2020-07-31 00:04:57 +00:00
336046b1d7
2020-07-21 19:32:50 +00:00
aa1afd29fc
2020-06-30 20:21:03 +00:00
a4fd59ce0a
2020-06-30 18:21:53 +00:00
75b51c7fda
2020-06-29 22:05:02 +00:00
7a00b85f54
2020-06-27 14:22:51 +00:00
50901186d3
2020-06-27 14:01:23 +00:00
3189d54266
2020-06-26 20:19:25 +00:00
3d4433d578
2020-06-26 18:22:11 +00:00
4412b3ca48
2020-06-25 17:24:10 +00:00
1e1553773c
2020-06-18 23:34:27 +00:00
bbcbdd86d0
clean up and various little improvements after search for static wasted memory objects (not found) At this point it appears I don't have any leaks and it's all pretty efficient.
2020-06-05 23:36:44 +00:00
3111f7fdb7
2020-06-05 19:06:31 +00:00
fd8c489914
changed all lambda experssion variables to z from various where appropriate
2020-05-18 19:42:42 +00:00
07390b6a31
Removed unused readOnly property on return response
2020-05-18 16:25:08 +00:00
1fb475827b
2020-05-13 23:15:47 +00:00
539d590ce8
Rename ConcurrencyToken to Concurrency
2020-05-13 19:54:41 +00:00
569fcaa7a6
jwt dltoken changes
2020-05-09 00:13:45 +00:00
60a79bab63
2020-05-08 23:56:55 +00:00
a640676ac3
2020-05-08 23:49:17 +00:00
e30db21b57
2020-05-08 19:10:56 +00:00
65e5d6ed2f
2020-04-25 22:22:13 +00:00
be8b25dcf8
2020-04-25 20:07:16 +00:00
ebca847c2b
2020-04-25 18:47:50 +00:00
31d4a361f8
2020-04-25 15:08:04 +00:00
00db05401f
2020-04-23 18:28:58 +00:00
d6420720db
2020-04-22 23:03:18 +00:00
