Classic298andkikayli d3737176bc fix: require write permission for pin_channel_message on standard channels (#24521) ...

`pin_channel_message` (channels.py:1242) checked `permission='read'` on
the standard-channel branch before mutating `is_pinned` / `pinned_by` /
`pinned_at` via `Messages.update_is_pinned_by_id`. Pin/unpin is a write
operation; gating it on read access let any user with read-only channel
access pin or unpin any message in the channel, including admin posts.

One-character fix: change `permission='read'` to `permission='write'`.

Reported by kikayli in GHSA-5gc6-xhv4-2wg6.

Co-authored-by: kikayli <kikayli@users.noreply.github.com>

2026-05-11 00:59:50 +09:00

..

analytics.py

chore: format

2026-04-12 18:12:59 -05:00

audio.py

chore: format

2026-05-09 15:25:27 +09:00

auths.py

fix:image url validation and signout post (#24420)

2026-05-09 07:33:31 +09:00

automations.py

refac

2026-04-21 13:46:39 +09:00

calendar.py

fix: gate public sharing of calendars behind sharing.public_calendars permission (#24493)

2026-05-09 23:18:51 +09:00

channels.py

fix: require write permission for pin_channel_message on standard channels (#24521)

2026-05-11 00:59:50 +09:00

chats.py

refac

2026-05-09 08:28:29 +09:00

configs.py

chore: format

2026-05-09 15:25:27 +09:00

evaluations.py

chore: format

2026-04-12 18:12:59 -05:00

files.py

Refactor file processing to use asyncio for transcribing, improving concurrency. (#24379)

2026-05-09 03:17:47 +09:00

folders.py

chore: format

2026-04-12 18:12:59 -05:00

functions.py

chore: format

2026-04-21 15:52:00 +09:00

groups.py

refac: async db

2026-04-12 14:22:11 -05:00

images.py

chore: add validate_url() to get_image_data() for cohort consistency hardening (#24518)

2026-05-11 00:59:32 +09:00

knowledge.py

chore: format

2026-04-19 22:45:54 +09:00

memories.py

chore: format

2026-04-17 14:28:18 +09:00

models.py

fix: strip model params for read-only callers on per-id endpoint (#24525)

2026-05-11 00:59:08 +09:00

notes.py

Merge pull request #24486 from Classic298/fix/notes-is-pinned-typeerror

2026-05-09 20:56:06 +09:00

ollama.py

refac

2026-05-09 04:17:58 +09:00

openai.py

chore: format

2026-05-09 15:25:27 +09:00

pipelines.py

refac

2026-04-20 08:53:06 +09:00

prompts.py

perf(prompts): make /tags fetch only the tags column with SQL access filter (#24287)

2026-05-09 05:20:13 +09:00

retrieval.py

chore: remove unauthenticated dead-code GET /api/v1/retrieval/ status endpoint (#24497)

2026-05-09 23:19:14 +09:00

scim.py

refac: async db

2026-04-12 14:22:11 -05:00

skills.py

fix: gate public sharing of skills behind sharing.public_skills on create/update (#24494)

2026-05-09 23:19:03 +09:00

tasks.py

refac

2026-05-09 05:14:55 +09:00

terminals.py

refac

2026-04-20 08:36:24 +09:00

tools.py

chore: format

2026-04-24 18:48:21 +09:00

users.py

fix: gate public sharing of calendars behind sharing.public_calendars permission (#24493)

2026-05-09 23:18:51 +09:00

utils.py

refac

2026-04-13 14:08:58 -05:00