A pending wiki suggestion can be read by id through GET /lore/{id} and its versions #836

New issue

Closed

opened 2026-09-26 14:09:37 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-09-26 14:09:37 +00:00

Collaborator

Found by the lane 8 survey (#734), read against origin/main at 20dcabd8. get_lore_entry filters out only deleted pages. So a pending suggestion (a lore proposal the GM hasn't accepted, which may hold material from the transcript that isn't meant for players yet) can be read by anyone in the campaign who knows or guesses its id. That works through:

GET /campaigns/{cid}/lore/{id};
that entry's versions endpoint.

The lists already leave proposals out, so this is the direct-id path only.

The fix: proposals are GM-only on every read path: the single entry, its versions, and anything else keyed by id. A non-GM gets 404, the same body as a missing entry, so existence isn't confirmed. Add a test per endpoint, as a player and as a GM.

Refs #734.

Found by the lane 8 survey (#734), read against `origin/main` at `20dcabd8`. `get_lore_entry` filters out only deleted pages. So a **pending suggestion** (a lore proposal the GM hasn't accepted, which may hold material from the transcript that isn't meant for players yet) can be read by anyone in the campaign who knows or guesses its id. That works through: - `GET /campaigns/{cid}/lore/{id}`; - that entry's versions endpoint. The lists already leave proposals out, so this is the direct-id path only. **The fix:** proposals are GM-only on every read path: the single entry, its versions, and anything else keyed by id. A non-GM gets **404**, the same body as a missing entry, so existence isn't confirmed. Add a test per endpoint, as a player and as a GM. Refs #734.

rbrooks referenced this issue from a commit

2026-09-26 14:21:52 +00:00

fix(webapp): a pending wiki proposal is not readable before a GM sees it (#836)

claude-bot referenced this issue from a pull request that will close it,

2026-09-26 14:21:54 +00:00

fix(webapp): a pending wiki suggestion can't be read by id (#836) #838

claude-bot closed this issue

2026-09-26 15:50:11 +00:00

claude-bot referenced this issue from a commit

2026-09-26 15:50:12 +00:00

Merge PR #838: a pending wiki suggestion can't be read by id (#836)

claude-bot commented

2026-09-26 15:54:37 +00:00

Author

Collaborator

Fixed by #838, merged 2026-09-26. A pending proposal is now 404 for non-GMs on the three id-keyed reads:

GET /lore/{id};
/versions, where membership is checked before the fetch so the answer isn't 403;
/lore/relationships?entry_id=, which returns an empty list.

The response body matches a missing entry. The test is test_proposal_read_leak.py (11 tests).

Fixed by #838, merged 2026-09-26. A pending proposal is now 404 for non-GMs on the three id-keyed reads: - `GET /lore/{id}`; - `/versions`, where membership is checked before the fetch so the answer isn't 403; - `/lore/relationships?entry_id=`, which returns an empty list. The response body matches a missing entry. The test is `test_proposal_read_leak.py` (11 tests).