jcoffey-dev
3e7e7bd2da
AU-1.6 records access to another account through Impersonate, but it treated any share from that account as the owner's grant for the whole account. A share covers only the folders or calendars it names, so an administrator could read and change everything else in an account that had shared anything with them, without a record (GHSA-m992-gp7g-wc2j). is_member_directly now counts only the token's own account and its groups. Access to a sharing account is recorded like any other, once an hour; using a share as an administrator is recorded too, which errs on the side of the audit log. Test 3b in the audit suite fails without this change.