Darko Gjorgjijoski e56b6b4fe5 fix(security): harden public EmailLog token endpoints (GHSA-73q7) (#669) ...

v3 port. Customer PDF controllers resolved the target document by raw
mailable_id ignoring mailable_type, and skipped expiry on the JSON endpoints.

- Resolve via $emailLog->mailable + assert the expected type (404) to close
  cross-type disclosure.
- Enforce isExpired() (403) on every public path incl. the JSON endpoints.
- Harden EmailLog::isExpired() against a null/unresolvable mailable.

Adds tests for cross-type 404, JSON-path expiry 403, and the valid path.

2026-06-12 11:02:11 +02:00

..

Admin

fix(security): enforce company scope on notes, doc-convert, and member bulk-delete (#668)

2026-06-12 11:02:08 +02:00

Ai

fix(security): gate AI tools by user ability and block admin-URL SSRF

2026-06-05 00:01:09 +02:00

Company

fix(security): gate AI tools by user ability and block admin-URL SSRF

2026-06-05 00:01:09 +02:00

Customer

fix(security): harden public EmailLog token endpoints (GHSA-73q7) (#669)

2026-06-12 11:02:11 +02:00