Incorrect Permissions on Post Office Endpoints

SEED-platform / seed

Standard Energy Efficiency Data (SEED) Platform™ is a web-based application that helps organizations easily manage data on the energy performance of large groups of buildings.

Other

110 stars 55 forks source link

Incorrect Permissions on Post Office Endpoints #4195

Open axelstudios opened 1 year ago

axelstudios commented 1 year ago

Describe the bug

The /v3/postoffice/* endpoints don't enforce the organization_id param, but org-membership is respected
The /v3/postoffice_email/* endpoints don't respect the organization_id param at all, and returns the entire table for everyone

Expected Behavior The endpoints should require the organization_id param, and should only allow access to organization owners.

github-actions[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity within 60 days. It will be closed if no further activity occurs. Thank you for your contributions.

github-actions[bot] commented 11 months ago

This issue has been automatically marked as stale because it has not had recent activity within 60 days. It will be closed if no further activity occurs. Thank you for your contributions.

github-actions[bot] commented 9 months ago

This issue has been automatically marked as stale because it has not had recent activity within 60 days. It will be closed if no further activity occurs. Thank you for your contributions.

github-actions[bot] commented 7 months ago

This issue has been automatically marked as stale because it has not had recent activity within 60 days. It will be closed if no further activity occurs. Thank you for your contributions.