To make sure annotations cannot be edited or removed through websockets I've prevented patches that add / remove layers or text annotations to be applied on MRIs.
It can now only be done from a project settings page.
I've not covered the case where a user send a whole object instead of a patch to the websocket server, but from what I understand this needs to be deprecated.
katjaq
commented
2 years ago
To make sure annotations cannot be edited or removed through websockets I've prevented patches that add / remove layers or text annotations to be applied on MRIs.
It can now only be done from a project settings page.
I've not covered the case where a user send a whole object instead of a patch to the websocket server, but from what I understand this needs to be deprecated.