kolaente e025209e3c fix(security): validate link share JWTs against DB on every request ...

Previously GetLinkShareFromClaims built a *LinkSharing entirely from JWT
claims with no DB interaction, so deleted shares and permission downgrades
took up to 72h (the JWT TTL) to take effect. The permission and sharedByID
claims were trusted blindly.

GetLinkShareFromClaims now takes an *xorm.Session, looks up the share via
GetLinkShareByID, verifies the hash claim against the DB row, and returns
ErrLinkShareTokenInvalid when the row is missing or the hash mismatches.
The permission and sharedByID claims are discarded; the DB row is
authoritative. GetAuthFromClaims opens a read session for the link-share
branch, mirroring the existing API-token branch.

Token creation and the JWT format are unchanged, so already-issued tokens
keep working except when the underlying share has been deleted or its hash
no longer matches.

Fixes GHSA-96q5-xm3p-7m84 / CVE-2026-35594.

2026-04-09 15:38:07 +00:00

..

ldap

fix(auth): skip profile updates for disabled LDAP users

2026-03-23 16:37:26 +00:00

oauth2server

test: add tests for OAuth 2.0 authorization flow

2026-03-27 23:05:04 +00:00

openid

fix: use assert.Empty instead of assert.Equal for empty string check

2026-04-08 09:49:14 +00:00

auth.go

fix(security): validate link share JWTs against DB on every request

2026-04-09 15:38:07 +00:00