Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Security fixes: P0-P2 complete (22 fixes)

Browse Source 
P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed
This commit is contained in:
Agent Zero
2026-07-25 21:03:46 +02:00
parent aaa7406929
commit 727d86614e
103 changed files with 6831 additions and 1053 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/plugins/builtins/system_notif/plugin.py
+4 -4
View File
@@ -54,7 +54,7 @@ class SystemNotifPlugin(BasePlugin):
await super().on_activate(db, service_container, event_bus)
from app.plugins.builtins.system_notif.participant_handler import SystemParticipantHandler
from app.plugins.builtins.kommunikation.participant_registry import get_participant_registry
from app.plugins.builtins.kommunikation.contracts import get_participant_registry
self._system_handler = SystemParticipantHandler(service_container)
registry = get_participant_registry()
@@ -64,7 +64,7 @@ class SystemNotifPlugin(BasePlugin):
async def on_deactivate(self, db, service_container, event_bus) -> None:
"""Unregister participant."""
from app.plugins.builtins.kommunikation.participant_registry import get_participant_registry
from app.plugins.builtins.kommunikation.contracts import get_participant_registry
get_participant_registry().unregister("system")
self._system_handler = None
@@ -132,7 +132,7 @@ class SystemNotifPlugin(BasePlugin):
import uuid
from app.core.db import create_db_session
from app.plugins.builtins.kommunikation.services import create_plugin_room, send_message
from app.plugins.builtins.kommunikation.contracts import create_plugin_room, send_message
tenant_id_str = payload.get("tenant_id")
user_id_str = payload.get("user_id")
@@ -201,7 +201,7 @@ class SystemNotifPlugin(BasePlugin):
# Find the System room conversation
from sqlalchemy import select
from app.plugins.builtins.kommunikation.models import CommConversation, CommParticipant
from app.plugins.builtins.kommunikation.contracts import CommConversation, CommParticipant
result = await db.execute(
select(CommConversation).where(