From code: F3 and F4 confirmed; F17 confirmed and re-rated medium (names and
links reach any address, no reports). New: SMTP certificate never checked (F30),
SMTP password returned to read-only roles (F31), SMTP credentials in the DEBUG
defaults of raven and sockeye source (F32; password to be rotated). Review only,
nothing sent.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
F27 (high, confirmed on the local server): restricted roles get whole work-order
items through report data, rendering and export. From code: users with change
rights on Customer can give contact logins any role (F28); server-info gives
the DB ID and licence to every login (F29). Remaining routes without a role
check found OK. Review only, no code changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
From code: KPI interval criterion placed in SQL unchecked, reachable by staff
down to TechRestricted (F26, critical). F18 (pick-list search text) completed
by code. Data-list filters, sort, ClientCriteria, saved filters, search, other
KPI criteria and remaining raw queries traced and found safe. Review only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
From code: logo upload accepts any content type and is served inline from the
app's origin (F23); translation import has no role check (F24); attachment and
export gaps (F25). F21 extended to the log and backup download routes; backup
delete found safe. Review only, no code changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
F19 (critical, confirmed on the local server): report template import has no
role check, so any login, customer contacts included, can add a template whose
JavaScript runs in the server's browser. From code: F20 (templates get the
renderer's token, SuperUser for customer notification reports, and unrestricted
network access), F21 (download file names from the URL not checked; Windows),
F22 (minor job and template gaps). Review only, no code changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Routes the client calls for customer contacts, read from raven-client, with the
ownership check each id route needs, and the proposed shape of the fix
(allowlist in the token middleware plus per-route ownership checks).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
John's decision: 8.3.0 is not released until every finding is fixed or
explicitly accepted. The review therefore runs before the release, not after.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
John's decision: urgent, "next release" cases before 8.3.0; hosted and
self-hosted installations equally. Recorded in SECURITY-REVIEW.md and in the
NET10-PORT.md list of cases for this release.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Confirmed on the local server as the seeded contact: any customer's work order
by id (F13), other customers' service requests (F14), the full customer list
with phones and emails through pick lists (F15), the whole service schedule
(F16). Candidates from code: notification subscriptions for another user (F17),
pick-list search text placed in SQL unescaped (F18). Review only, no code changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
F5 (critical, confirmed on the local server): the 2FA step accepts an empty or
missing temp token, so users with 2FA on can be logged into without a password.
F1 confirmed: with the placeholder secret a user's current token can be rebuilt.
F8 confirmed. New findings F6, F7, F9 to F12. Review only, no code changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
