Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Code monitors: fix issue with action/trigger perms checking #37526

Merged
merged 1 commit into from Jun 21, 2022

Conversation

camdencheek
Copy link
Member

This fixes an issue that allows non-owner users to modify triggers and actions that they don't own. The fix here updates our DB access code to always check that the caller is also the owner of the monitor the trigger/action belongs to.

Test plan

Added tests.

@cla-bot cla-bot bot added the cla-signed label Jun 21, 2022
@camdencheek camdencheek requested a review from a team June 21, 2022 22:26
@camdencheek camdencheek merged commit d8c1e48 into main Jun 21, 2022
21 checks passed
@camdencheek camdencheek deleted the cc/fix-cm-vulnerability branch June 21, 2022 23:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants