mirror of
https://github.com/Luchexx/wacrm.git
synced 2026-11-02 09:19:51 +00:00
2b32308703
C1 (Critical): the profiles_update RLS policy gates only on user_id, leaving account_role/account_id — the source of truth for is_account_member() — freely writable by the row's own user. A browser-client UPDATE could self-promote a viewer to owner or move into another tenant. Add a BEFORE UPDATE trigger that rejects changes to those columns when current_user = 'authenticated'; the SECURITY DEFINER member/invitation RPCs (postgres) and the service_role backend are unaffected. H2 (High): match_ai_knowledge_fts/_semantic were SECURITY DEFINER, filtered only on the caller-supplied p_account_id with no membership check, and were granted to authenticated — letting any logged-in user read another account's knowledge base via a foreign p_account_id. Recreate both as SECURITY INVOKER so the existing ai_knowledge_chunks_select RLS policy applies; the service_role auto-reply bot still bypasses RLS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| 001_initial_schema.sql | ||
| 002_pipelines_enhancements.sql | ||
| 003_broadcast_recipient_wamid.sql | ||
| 004_contact_delete_set_null.sql | ||
| 005_broadcast_counts_incremental.sql | ||
| 006_automations.sql | ||
| 007_automations_increment_counter.sql | ||
| 008_profile_avatars_storage.sql | ||
| 009_message_actions.sql | ||
| 010_flows.sql | ||
| 011_profile_beta_features.sql | ||
| 012_flows_increment_counter.sql | ||
| 013_whatsapp_config_phone_number_id_unique.sql | ||
| 014_message_templates_meta_integration.sql | ||
| 015_whatsapp_config_registration.sql | ||
| 016_flow_media.sql | ||
| 017_account_sharing.sql | ||
| 018_account_member_rpcs.sql | ||
| 019_invitation_rpcs.sql | ||
| 020_account_sharing_followups.sql | ||
| 021_account_default_currency.sql | ||
| 022_contact_phone_dedup.sql | ||
| 023_chat_media.sql | ||
| 024_member_presence.sql | ||
| 025_filter_contacts_by_tags.sql | ||
| 026_api_keys.sql | ||
| 027_notifications.sql | ||
| 028_webhook_endpoints.sql | ||
| 029_ai_reply.sql | ||
| 030_ai_knowledge.sql | ||
| 031_fix_profiles_update_rls.sql | ||
| 032_fix_ai_knowledge_membership.sql | ||