93e2d6823c
The categorization, bulk rule re-evaluation, and automation-rule apply status endpoints looked jobs up by a bare job UUID. Any authenticated user who obtained another user's job id could poll its progress payload. Include the owning user's id in the cache key so a status request keyed by the polling user's id can only resolve that user's own jobs; a mismatched owner now falls through to the existing 404. No ownership store or extra lookup needed. Added cross-user isolation tests for all three endpoints. |
||
|---|---|---|
| .. | ||
| .pest | ||
| Browser | ||
| Feature | ||
| Performance | ||
| Support | ||
| Unit | ||
| Pest.php | ||
| TestCase.php | ||
| bootstrap.php | ||