OwnCord

J3vb/OwnCord

Fork 0

mirror of https://github.com/J3vb/OwnCord.git synced 2026-09-03 03:50:00 +03:00

Files

T

History

J3vbandClaude Opus 5 1da2aaddf0 fix(service): apply the full read/announcement gate to message edits (F3)

EditMessage authorized the non-DM path with permissions.SendMessages alone
while every sibling message sink requires ReadMessages plus the mutate bit, so
a user denied READ_MESSAGES could still rewrite an old post and have the edit
broadcast to the channel. The edit gate now calls the existing
checkSendPermission helper and collapses its error into the sink's
pre-existing opaque ErrForbidden, so the reply stays a non-oracle.

Verified by a panel of agents; the added test fails against the unpatched
tree, showing the edit succeeded before the fix.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-07-30 15:01:21 +02:00

block_test.go

test: close measured test-coverage gaps across server, client and Rust

2026-07-25 14:47:21 +00:00

block.go

feat(server): logging & error-visibility hardening

2026-07-24 11:07:12 +02:00

channel_test.go

fix(security): close all 13 findings from the 2026-07-28 server scan, plus dependabot rollup (#1264 )

2026-07-29 12:48:47 +02:00

channel.go

fix(security): close all 13 findings from the 2026-07-28 server scan, plus dependabot rollup (#1264 )