inbuxa/inbuxa-server
1
1 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 54 Wiki Activity Sponsor

Release 2026.10.10.1 #185

Merged
jcoffey-dev merged 1 commits from release/2026.10.10.1 into main 2026-10-10 05:39:09 +00:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
jcoffey-dev commented 2026-10-10 04:54:55 +00:00
Owner
Copy link
Copy source

The audit fix (#184), plus #180, #181, #182 and #183 since 2026.10.10. Merge after #184.

The audit fix (#184), plus #180, #181, #182 and #183 since 2026.10.10. Merge after #184.
jcoffey-dev added 2 commits 2026-10-10 04:54:55 +00:00
Audit an administrator's access to a sharing account
ci / fork-checks (pull_request) Skipped
Details
ci / build (pull_request) Skipped
Details
github/ci (branch) GitHub Actions
Details
ci / github (pull_request) Successful in 7m5s
Details
3e7e7bd2da 
AU-1.6 records access to another account through Impersonate, but it
treated any share from that account as the owner's grant for the whole
account. A share covers only the folders or calendars it names, so an
administrator could read and change everything else in an account that
had shared anything with them, without a record (GHSA-m992-gp7g-wc2j).

is_member_directly now counts only the token's own account and its
groups. Access to a sharing account is recorded like any other, once an
hour; using a share as an administrator is recorded too, which errs on
the side of the audit log.

Test 3b in the audit suite fails without this change.
Release 2026.10.10.1
ci / fork-checks (pull_request) Skipped
Details
ci / build (pull_request) Skipped
Details
github/ci (branch) GitHub Actions
Details
ci / github (pull_request) Successful in 7m26s
Details
0bca061da0
jcoffey-dev merged commit 118dd3faea into main 2026-10-10 05:39:09 +00:00
jcoffey-dev deleted branch release/2026.10.10.1 2026-10-10 05:39:09 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something isn't working
 dependencies
Dependency updates
 documentation
Docs, README or site copy
 duplicate
Already tracked elsewhere
 enhancement
New feature or improvement
 good first issue
Good for newcomers
 help wanted
Contributions welcome
 invalid
Not a valid issue
 needs info
Waiting on the reporter for details
 question
Needs an answer, not a code change
 security
Security issue or hardening
 translation
New language or translation fixes
 wontfix
Will not be worked on
priority
p1
High priority
priority
p2
Medium priority
priority
p3
Low priority
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcoffey-dev (John Coffey)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: inbuxa/inbuxa-server#185