mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-19 13:23:50 +03:00
25d35179fd
/api/files, /api/files/[id]/content, /api/batches and /api/batches/[id] only gated on requireManagementAuth(request), which returns null unconditionally when settings.requireLogin===false, and never applied any per-record ownership check. On an instance with login disabled, an unauthenticated caller could enumerate/download every tenant's files and batches — the hardened /api/v1/files and /api/v1/batches siblings already scope via getApiKeyRequestScope()/resolveListScope()/ canAccessOwnedRecord() from the GHSA-2jm2-mpx8-6523 and GHSA-m3hp-hq9g-fpmv fixes. Port that exact scoping onto the 4 management routes: an API key sees only its own files/batches, a dashboard session keeps instance-wide access, and any other caller is rejected instead of falling through to an unscoped read.