John Cardinal 87fdc12dce
case 4712 - notification subscriptions are the caller's own; object events only to subscribers who may read the record type ...
Step 6 of 4712 (security review F17). A subscription kept the UserId sent by
the client, and object events (created, modified, deleted, age) were matched by
record type only, so a user could get record names of types it may not read,
delivered to any address. Now a subscription is created for the caller and an
update cannot move it to another user, unless the caller administers users; and
object events skip subscribers without read rights on the record type.
Checked: Service's subscription asked for SuperUser is saved as its own; with
"customer created" subscriptions, Inventory (no read on customers) got 0 events,
Service 1. Full suite: 109 passed, 5 skipped, the same 2 known failures.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-24 14:39:40 -07:00
2022-01-21 00:46:44 +00:00
2023-03-22 00:02:46 +00:00
2022-01-06 00:26:34 +00:00
2021-07-29 22:09:41 +00:00
2022-11-20 23:58:03 +00:00
2022-06-23 00:34:31 +00:00
2021-07-27 19:13:51 +00:00
2022-06-15 01:16:42 +00:00
2022-03-04 22:44:44 +00:00
2021-11-10 01:02:09 +00:00
2022-06-23 00:34:31 +00:00
2023-02-22 23:54:16 +00:00
2024-04-29 18:49:50 +00:00
2023-11-09 20:02:11 +00:00
2022-03-06 18:40:30 +00:00
2022-09-28 19:13:20 +00:00
2024-10-23 23:40:31 +00:00
2021-07-12 17:19:09 +00:00
2021-11-10 01:02:09 +00:00
2021-11-22 20:30:03 +00:00
2021-11-10 01:02:09 +00:00
2022-01-26 18:31:29 +00:00
2022-12-13 22:24:06 +00:00
2021-09-22 18:45:39 +00:00
2021-11-18 23:45:16 +00:00
2021-07-12 17:19:09 +00:00
2021-07-12 17:19:09 +00:00
2023-05-09 22:23:54 +00:00
2021-12-28 00:44:27 +00:00
2022-03-24 22:29:44 +00:00
2022-03-23 00:50:44 +00:00
2022-06-23 20:35:37 +00:00
2021-12-28 00:44:27 +00:00
2021-09-03 23:48:41 +00:00
2023-04-26 17:57:50 +00:00
2022-09-27 23:06:28 +00:00
2023-05-08 22:54:18 +00:00
2023-02-22 23:54:16 +00:00
2022-09-28 19:13:20 +00:00
2026-10-24 14:39:40 -07:00
2022-11-20 23:58:03 +00:00
2026-10-24 14:39:40 -07:00
2023-02-22 23:54:16 +00:00
2022-09-28 19:13:20 +00:00
2022-03-29 17:43:38 +00:00
2021-12-30 01:01:59 +00:00
2021-12-30 01:01:59 +00:00
2023-02-22 23:54:16 +00:00
2021-09-09 00:06:16 +00:00
2024-10-23 23:10:16 +00:00
2021-07-28 15:28:09 +00:00
2022-08-23 21:41:20 +00:00
2023-02-22 23:54:16 +00:00
2022-12-13 22:49:47 +00:00
2024-10-23 23:10:16 +00:00
2022-03-18 14:34:57 +00:00
2022-09-28 19:13:20 +00:00
2021-09-03 15:15:09 +00:00
2026-10-24 13:52:31 -07:00
2022-01-26 22:54:09 +00:00
2022-09-28 19:13:20 +00:00
2022-03-11 19:54:00 +00:00
2021-12-28 00:44:27 +00:00
2023-02-22 23:54:16 +00:00
2021-10-19 19:46:57 +00:00
2023-02-22 23:54:16 +00:00
2023-02-22 23:54:16 +00:00
2023-01-27 17:15:14 +00:00
2023-02-22 23:54:16 +00:00
2022-03-15 23:26:06 +00:00
2024-04-29 18:41:04 +00:00
2022-10-27 22:02:47 +00:00
2023-02-22 23:54:16 +00:00
2026-10-24 13:52:31 -07:00
2023-02-22 23:57:24 +00:00
2023-05-09 22:23:54 +00:00
2026-10-24 13:52:31 -07:00
2023-02-22 23:54:16 +00:00
2023-02-22 23:54:16 +00:00
2021-08-17 23:25:35 +00:00
2023-02-22 23:54:16 +00:00
John Cardinal
87fdc12dce