mjacobus / khtools / 36572376891

77%

push

github

Only allow publishers in groups from their own congregation

The publisher form permits group_id as-is, so a crafted request could
place a publisher in another congregation's field service group. The
model now rejects a group whose account differs from the publisher's.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

5 of 5 new or added lines in 1 file covered. (100.0%)

2883 of 3752 relevant lines covered (76.84%)

33.67 hits per line