Kyle Pope 206144d20d Fix 2 pentest findings: unlock permission check + permanent lock preservation ...

SC-01: unlock_event now verifies caller has access to the calendar before
revealing lock state. Previously any authenticated user could probe event
existence via 404/204/403 response differences.

SC-02: acquire_lock no longer overwrites permanent locks. If the owner holds
a permanent lock and clicks Edit, the existing lock is returned as-is instead
of being downgraded to a 5-minute temporary lock.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-06 23:37:05 +08:00

..

__init__.py

Initial commit

2026-02-15 16:13:41 +08:00

admin.py

Phase 2: Shared calendars backend core + QA fixes

2026-03-06 04:46:17 +08:00

auth.py

Fix registration enumeration + contact detail panel name sync

2026-03-06 00:31:10 +08:00

calendars.py

M-01+M-03: Add input validation and extra=forbid to all request schemas

2026-02-27 15:43:55 +08:00

connections.py

Phase 2: Shared calendars backend core + QA fixes

2026-03-06 04:46:17 +08:00

dashboard.py

Fix TS build errors and apply remaining QA fixes

2026-02-27 04:42:23 +08:00

event_templates.py

M-01+M-03: Add input validation and extra=forbid to all request schemas

2026-02-27 15:43:55 +08:00

events.py

Fix two shared calendar bugs: lock banner missing and calendar not found on save

2026-03-06 17:16:35 +08:00

locations.py

M-01+M-03: Add input validation and extra=forbid to all request schemas

2026-02-27 15:43:55 +08:00

notifications.py

Address QA warnings W-02 through W-07

2026-03-05 23:55:11 +08:00

people.py

Fix QA: IntegrityError handling, dict mutation, birthday sync, None guard

2026-03-04 09:05:46 +08:00

projects.py

M-01+M-03: Add input validation and extra=forbid to all request schemas

2026-02-27 15:43:55 +08:00

reminders.py

M-01+M-03: Add input validation and extra=forbid to all request schemas

2026-02-27 15:43:55 +08:00

settings.py

Fix share name toggle revert and stale table data for umbral contacts

2026-03-04 08:07:45 +08:00

shared_calendars.py

Fix 2 pentest findings: unlock permission check + permanent lock preservation

2026-03-06 23:37:05 +08:00

todos.py

M-01+M-03: Add input validation and extra=forbid to all request schemas

2026-02-27 15:43:55 +08:00

totp.py

Extract real client IP from proxy headers instead of Docker bridge IP

2026-03-01 19:20:07 +08:00

weather.py

Fix QA review #2: W-03/W-04, S-01 through S-04

2026-02-27 05:41:16 +08:00