openwisp
/
openwisp-controller
/
38641340356
98%
master: 98%
master: 98%
|
Ran
|
Jobs
1
|
Files
143
|
Run time
1min
|
Badge
Embed ▾
README BADGES
|
coverage: 98.38% (+0.02%) from 98.361%
push
github
nemesifier[fix] Fixed insecure multi-tenancy boundary in location REST API Fixed a **security issue** that allowed organization managers to link locations and floorplans belonging to other organizations to their devices by submitting known object IDs. The API now resolves related objects only from organizations managed by the requesting user and validates the organization of all device-location relationships. Device lists for a location are scoped to managed organizations and no longer expose device keys. Nested location and floorplan writes are validated before being saved and run in a database transaction, preventing rejected requests from leaving related database objects or files behind. Advisory: **GHSA-39c4-xj33-j8j3**. [backport 1.3] --------- Co-authored-by: Federico Capoano <f.capoano@openwisp.io> (cherry picked from commit 55bdae7dc)
7833 of 7962 relevant lines covered (98.38%)
7.87 hits per line
Coverage Regressions
| Lines | Coverage | ∆ | File |
|---|---|---|---|
| 4 |
98.48
|
0.15% | geo/api/serializers.py |
| 2 |
98.65
|
0.5% | geo/api/views.py |
Jobs
| ID | Job ID | Ran | Files | Coverage | |
|---|---|---|---|---|---|
| 1 | python- - 38641340356.1 | 143 |
98.38
|
GitHub Action Run |
