fix(security): authz, IDOR, and abuse-prevention fixes - #4944

Merged

waleedlatif1 merged 36 commits into

Jun 10, 2026

Commits on Jun 10, 2026

fix(knowledge): require write access for batch chunk operations
waleedlatif1
committed
6d09bdd
fix(env): restrict decrypted workspace env vars to secret admins
waleedlatif1
committed
de605eb
fix(files): block cross-tenant deletion via client-controlled context
waleedlatif1
committed
b8c7f3d
fix(telegram): verify X-Telegram-Bot-Api-Secret-Token on inbound webhooks
waleedlatif1
committed
3ed97a4
fix(security): pin DNS for Agiloft directExecution and Grafana update tools
waleedlatif1
committed
ec3e66e
fix(api): enforce workspace allowPersonalApiKeys policy on v1 surface
waleedlatif1
committed
a772066
fix(billing): close usage-cap admission race with atomic reservation
waleedlatif1
committed
2e9a09c
fix(workflows): validate folderId belongs to workflow's workspace on create/update/reorder
waleedlatif1
committed
9417348
fix(folders): validate parentId against workspace on create/update/reorder
waleedlatif1
committed
5a482a4
chore(knowledge): drop non-TSDoc inline comments from chunks route
waleedlatif1
committed
61d8f49
fix(webhooks): fail closed when HMAC signing secret is not configured
waleedlatif1
committed
5b6cae9
style(files): trim verbose inline comments on delete authorization fix
waleedlatif1
committed
00e29d0
fix(auth): close account-enumeration oracle on email sign-up
waleedlatif1
committed
be0963c
style(tools): drop non-TSDoc inline comments from Grafana/Agiloft SSRF tools
waleedlatif1
committed
6d50823
chore(api): trim extraneous inline comments in v1 logs/files routes
waleedlatif1
committed
b9aeab6
fix(billing): exclude table-cell dispatch from admission reservation
waleedlatif1
committed
2979061
fix(chat): rate-limit and constant-time password auth for public chats
waleedlatif1
committed
86e26b8
fix(security): cap JSON request body size and gate public chat endpoint
waleedlatif1
committed
595b678
fix(chat): rate-limit and constant-time password auth for public chats
waleedlatif1
committed
62764cb
fix(billing): never block a lone execution on usage headroom
waleedlatif1
committed
ac56525
refactor(env): document workspace env masking, drop inline comments
waleedlatif1
committed
26f3cba
refactor(env): convert PUT/DELETE authz comments to TSDoc
waleedlatif1
committed
87dface
fix(telegram): keep legacy webhooks working via Telegram source-IP fallback
waleedlatif1
committed
41f133a
fix(chat): restore constant-time password auth and IP rate limit
waleedlatif1
committed
536af73
revert(webhooks): undo trigger auth hardening pending compat plan
waleedlatif1
committed
9b246ba
test(chat): make RateLimiter mock a constructable class
waleedlatif1
committed
8e3984c
fix(billing): release admission slot on pre-execution aborts; cluster-safe release
waleedlatif1
committed
b9d004a
improvement(files): log missing owner metadata distinctly on profile-picture delete deny
waleedlatif1
committed
b232229
fix(billing): release admission slot when async enqueue fails
waleedlatif1
committed
cbfe114
fix(api): make body-size caps NaN-safe and raise chat input/attachment limits
waleedlatif1
committed
cb0beb3
fix(hooks): restore void return in useInlineRename onSave type
waleedlatif1
committed
7e012af
fix(billing,api): release chat reservation slot on early exit; preserve 413 on oversized import
waleedlatif1
committed
74a39b3
fix(icons): make Infisical icon black for contrast; regenerate docs
waleedlatif1
committed
7927336
fix(billing): release reserved slot on execute-route 503 and setup throw
waleedlatif1
committed
eaf7392
fix(icons): make Linkup icon black for contrast
waleedlatif1
committed
8975698
fix(billing): release reserved slot if inline async job never starts
waleedlatif1
committed
95d724d