Skip to content

0.10.1 — lock down shared catalogue

Choose a tag to compare

View all tags
@iprashantraj iprashantraj released this 23 May 22:32
· 14 commits to main since this release
v0.10.1
798ddb5

Security fix

Closes a hole where any signed-in user could overwrite rows in the shared `problems` catalogue (difficulty, topics, title) and have those changes propagate to every other user's dashboard.

  • DB: dropped the open UPDATE policy on `problems`. Only the service_role (admin) can modify existing rows now.
  • Extension: `syncProblems` switched from `merge-duplicates` to `ignore-duplicates` so it silently skips slugs already in the catalogue instead of attempting a (now-denied) UPDATE.

No user-visible change. Catalogue still populates organically from new GraphQL fetches.

Install

Same as before — download the zip, load unpacked, sign in. If you already have it installed: just hit reload at `chrome://extensions` and confirm version 0.10.1.

Assets 3
Loading