2adc040a8f
Previously, attachments relied only on blob_id, which made it possible to attach blobs across accounts by enumerating IDs. We now require both blob_id and blob_key, add cross-account validation to prevent blob reuse, and centralize the logic in a shared BlobOwnershipValidation concern. It also fixes a frontend bug where mixed-type action params (number + string) were incorrectly dropped, causing attachment uploads to fail. |
||
|---|---|---|
| .. | ||
| .keep | ||
| access_token_auth_helper.rb | ||
| attachment_concern.rb | ||
| auth_helper.rb | ||
| domain_helper.rb | ||
| ensure_current_account_helper.rb | ||
| google_concern.rb | ||
| hmac_concern.rb | ||
| instagram_concern.rb | ||
| label_concern.rb | ||
| meta_token_verify_concern.rb | ||
| microsoft_concern.rb | ||
| notion_concern.rb | ||
| request_exception_handler.rb | ||
| switch_locale.rb | ||
| twitter_concern.rb | ||
| website_token_helper.rb | ||