Address security issues in the signup module - #667

Merged

vagisha merged 9 commits into

release26.7-SNAPSHOTfrom

26.7_fb_signup-security

Jul 28, 2026

Commits on Jul 25, 2026

Fix security issues in signup module.
vagisha
committed
c5a2963
SignUpController.validateGroupChangeTarget now rejects a target group that carries AdminPermission (admin rights) in any subfolder of the
vagisha
and
claude
committed
bd77688
Emailed the account owner when signup hits an existing address
vagisha
and
claude
committed
ee4451e
Added a self-service group-change security test and a distinct rejection status
vagisha
and
claude
committed
f601fe8

Commits on Jul 26, 2026

Hardened the signup enumeration response and added audit checks to the group-change test
vagisha
and
claude
committed
d6caf09
Addressed code-review findings on the signup security changes
vagisha
and
claude
committed
9be75ff
Removed unused import
vagisha
committed
9dbfa81

Commits on Jul 27, 2026

SignUpController: added group ids to the self-service group-change audit message, matching the admin-config audit events
vagisha
committed
7919517

Commits on Jul 28, 2026

Addressed review feedback on the signup group-change validation
vagisha
and
claude
committed
6aaeeb3