John Cardinal e58ab2c100 case 4715 - download file names checked ...

report/download and export/download (any download key), the log-file routes and
backup download built a path from the file name in the URL with Path.Combine
and no check, so on Windows a name with a folder part or an absolute path could
reach files outside the folder (security review F21). New helper
FileUtil.FullPathInFolderOrNull accepts only a bare file name that resolves
directly inside the folder; TemporaryFileExists and BackupFileExists use it
(the download routes already call them first), and so do both log routes.
A refused name gets the same 404 as a missing file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-24 12:20:25 -07:00

..

ApiRootController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

AttachmentController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

AuthController.cs

case 4710 - 2FA step requires the temp token from the password step

2026-10-24 11:28:17 -07:00

AuthorizationRolesController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

BackupController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ContractController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

CustomerController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

CustomerNoteController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

CustomerNotifySubscriptionController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

CustomerServiceRequestController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

DashboardViewController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

DataListColumnViewController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

DataListController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

DataListSavedFilterController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

EnumListController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

EventLogController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ExportController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

FormCustomController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

FormFieldsDefinitionsController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

FormUserOptionsController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

GlobalBizSettingsController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

GlobalOpsBackupSettingsController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

GlobalOpsNotificationSettingsController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

HeadOfficeController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

HealthController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ImportController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

IntegrationController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

JobOperationsController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

KPIController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

LicenseController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

LoanUnitController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

LogFilesController.cs

case 4715 - download file names checked

2026-10-24 12:20:25 -07:00

LogoController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

MemoController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

NameController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

NotifyController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

NotifySubscriptionController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

PartAssemblyController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

PartController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

PartInventoryController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

PartWarehouseController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

PickListController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

PMController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ProjectController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

PurchaseOrderController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

QuoteController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

QuoteStatusController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ReminderController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ReportController.cs

case 4718 - report and translation import need create rights

2026-10-24 12:10:00 -07:00

ReviewController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ScheduleController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

SearchController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ServerMetricsController.cs

case 4690 - remove MiniProfiler (never used): packages, wiring, profiler auth workaround, credits entry

2026-10-22 18:49:28 -07:00

ServerStateController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ServiceBankController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

ServiceRateController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

TagController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

TaskGroupController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

TaxCodeController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

TranslationController.cs

case 4718 - report and translation import need create rights

2026-10-24 12:10:00 -07:00

TravelRateController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

TrialController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

UnitController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

UnitModelController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

UserController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

UserOptionsController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

VendorController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

WorkOrderController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

WorkOrderItemPriorityController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

WorkOrderItemStatusController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00

WorkOrderStatusController.cs

case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this

2024-05-09 22:56:53 +00:00