search

CaravanStudios / open-product-recovery

Apache License 2.0
26 stars 20 forks source link

SqlOprPersistentStorage does not specify hostOrgUrl during reshare chain lookups #72

Open johndayrichter opened 1 year ago

johndayrichter commented 1 year ago

All lookups of reshare chains in SqlOprPersistentStorage fail to specify a host org url, allowing reshare chains from one organization to leak to others. This could allow an organization to be given a reshare chain it cannot use.