mirror of
https://github.com/chatwoot/chatwoot.git
synced 2026-06-16 21:06:22 +08:00
Previously, attachments relied only on blob_id, which made it possible to attach blobs across accounts by enumerating IDs. We now require both blob_id and blob_key, add cross-account validation to prevent blob reuse, and centralize the logic in a shared BlobOwnershipValidation concern. It also fixes a frontend bug where mixed-type action params (number + string) were incorrectly dropped, causing attachment uploads to fail. |
||
|---|---|---|
| .. | ||
| accounts | ||
| integrations | ||
| profile | ||
| widget | ||
| accounts_controller.rb | ||
| notification_subscriptions_controller.rb | ||
| profiles_controller.rb | ||
| webhooks_controller.rb | ||