1
84%
master: 84%

Ran 18 Apr 2026 12:38AM UTC

Files 50

Run time 1s

Badge

Embed ▾

Committed 18 Apr 2026 12:35AM UTC coverage: 84.16% (-0.2%) from 84.345%

Job # 24592686760.1

Build Type

push

github

Committed by

umputun

Commit Message

fix(api): require explicit ?site= in matchSiteID middleware

matchSiteID guarded most authenticated and admin routes with
`if siteID != "" && user.SiteID != siteID`. Dropping the ?site= query
parameter made the check no-op and any authenticated user passed the
middleware. Downstream handlers fell back to reading site from the JSON
body or just used the empty string, so on email/telegram subscribe
endpoints (which read site from body) a user authenticated to siteA
could perform actions targeting siteB without the cross-site guard
ever firing.

Require ?site= to be present and to match user.SiteID. Body-only site
flows are still supported provided the URL also carries the matching
?site= — both must agree, which removes the bypass and keeps the
declared site visible to the middleware.

Reproduction TestRest_matchSiteID enumerates four cases (matching,
mismatched, missing, empty). Existing test calls that relied on the
implicit pass had to add ?site=remark42 to the URL: the addComment
helper now derives the param from c.Locator.SiteID, picture upload
URL gets the param explicitly, and the email/telegram subscribe table
adds it to every endpoint. The negative cases that previously asserted
StatusBadRequest from the handler now correctly assert StatusForbidden
from the middleware.

Coverage Stats

6211 of 7380 relevant lines covered (84.16%)

34.56 hits per line

umputun / remark42 / 24592686760 / 1
84%
master: 84%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 24592686760.1

umputun / remark42 / 24592686760 / 1 84% master: 84%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 24592686760.1

umputun / remark42 / 24592686760 / 1
84%
master: 84%

README BADGES
x