John Cardinal 87fdc12dce case 4712 - notification subscriptions are the caller's own; object events only to subscribers who may read the record type ...

Step 6 of 4712 (security review F17). A subscription kept the UserId sent by
the client, and object events (created, modified, deleted, age) were matched by
record type only, so a user could get record names of types it may not read,
delivered to any address. Now a subscription is created for the caller and an
update cannot move it to another user, unless the caller administers users; and
object events skip subscribers without read rights on the record type.

Checked: Service's subscription asked for SuperUser is saved as its own; with
"customer created" subscriptions, Inventory (no read on customers) got 0 events,
Service 1. Full suite: 109 passed, 5 skipped, the same 2 known failures.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-24 14:39:40 -07:00

11 KiB

Raw Blame History

View Raw