naibaandnaiba/CloudCode 710a2c731c fix(controller): hide foreign server IDs from forceUpdateServer response ...

The previous loop only checked ownership inside the
\`server != nil && server.TaskStream != nil\` branch. A foreign online
server returned permission denied for the whole batch while foreign
offline / unknown IDs silently went into the Offline bucket — the
response-shape delta let a RoleMember enumerate other users' online
server IDs by submitting them in batches.

Drop both foreign and unknown IDs silently into the Offline bucket
(without dispatching the upgrade task) so the response is indistinguishable
across those three states.

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

2026-05-18 15:16:59 +00:00

..

waf

fix: add a default error message for waf page (#1145)

2025-12-04 21:52:12 +08:00

alertrule.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

controller.go

fix(controller): restrict waf and online-user listings to admins

2026-05-17 10:24:19 +08:00

cron.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

ddns.go

ddns: support provider hurricane electric (#1036)

2025-03-19 21:52:16 +08:00

fm.go

fix(rpc): bind io_stream sessions to creator to prevent terminal/fm hijack

2026-05-18 15:16:40 +00:00

force_update_ownership_test.go

fix(controller): hide foreign server IDs from forceUpdateServer response

2026-05-18 15:16:59 +00:00

jwt_test.go

test: cover multi-user permission boundaries

2026-05-17 10:24:19 +08:00

jwt.go

improve: not block ip when ip changed

2025-10-10 09:53:15 +08:00

nat.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

notification_group.go

fix(controller): filter listing endpoints by ownership

2026-05-17 10:24:19 +08:00

notification.go

feat(notification): add option to convert metric units in request body (#1156)

2026-01-10 17:29:10 +08:00

oauth2.go

fix: 恢复被误删的 AuthCodeURL 调用，修复编译失败

2026-03-01 04:05:53 +00:00

permission_matrix_test.go

test: cover multi-user permission boundaries

2026-05-17 10:24:19 +08:00

permissions.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

server_group.go

fix(controller): filter listing endpoints by ownership

2026-05-17 10:24:19 +08:00

server.go

fix(controller): hide foreign server IDs from forceUpdateServer response

2026-05-18 15:16:59 +00:00

service.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

setting.go

feat(v2.0.0): tsdb (#1162)

2026-02-15 13:13:33 +08:00

stream_ownership_test.go

fix(rpc): bind io_stream sessions to creator to prevent terminal/fm hijack

2026-05-18 15:16:40 +00:00

terminal.go

fix(rpc): bind io_stream sessions to creator to prevent terminal/fm hijack

2026-05-18 15:16:40 +00:00

user.go

fix: member-created services shouldn't be applied to admin resources (#1113)

2025-08-28 22:37:44 +08:00

waf.go

feat(waf): return ip in string literal (#947)

2025-01-04 20:49:14 +08:00

ws_stream_visibility_test.go

fix(ws): scope server stream visibility to viewer ownership

2026-05-17 03:41:28 +00:00

ws.go

fix(ws): scope server stream visibility to viewer ownership

2026-05-17 03:41:28 +00:00