Repository navigation
v13.02
In short
UnassignedArchiveBleed is fixed: a member with the
Normal, assigned only role archives and converts only the cards assigned
to them, through every card method.
Security
An assigned-only member archives and converts only the cards assigned to them. Thanks to tsurutanmen and xet7.
UnassignedArchiveBleed,
GHSA-6xqf-jh8x-4wxc.
The DDP methods archiveSelectedCards and createBoardFromCard asked only
for the board's write capability, which the Normal, assigned only role has, so
such a member who knew a card's id archived any card of the board - and its
subtasks - and turned any card into a linked-board card. Both now also ask
the card, as copyCard does; a selection is checked whole before the first
card is archived. A refusal is shown in Admin Panel / Problems.
tests/assignedCardMethods.test.cjs fails for any server method that takes a
card id and decides by the board's write access alone.
Thanks to above GitHub users for their contributions.