Dave Horton bff9314622 fix(security): add authorization checks to prevent cross-account access (CWE-639) (#558) ...

- Add precondition support to decorate.js retrieve function
- Fix google-custom-voices.js typo and add delete precondition
- Check ownership via speech_credential for google-custom-voices
- Add retrieve/delete preconditions to lcr-carrier-set-entries.js
- Add retrieve precondition to sip-gateways.js and smpp-gateways.js
- Add scope check to lcr-routes.js custom GET handler
- Add full authorization to tenants.js for all CRUD operations
- Add scoped query methods to tenant model

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

2026-06-27 15:53:51 -04:00

..

account-limits.js

Feature/sp call limits (#63)

2022-09-20 22:55:28 +02:00

account.js

Feat/obscure sensitive bucket credentials (#375)

2025-01-03 07:12:44 -05:00

api-key.js

no need to update api_key use date more than once per minute (#506)

2025-10-28 17:18:22 -04:00

application.js

Feat/sql improvements (#536)

2026-01-15 08:45:40 -05:00

client.js

correct clients.password col name (#373)

2024-12-28 16:42:32 -05:00

google-custom-voice.js

google custom voice (#245)

2023-10-30 20:29:12 -04:00

lcr-carrier-set-entry.js

added schema changes for LCR (#150)

2023-05-05 20:09:34 -04:00

lcr-route.js

added schema changes for LCR (#150)

2023-05-05 20:09:34 -04:00

lcr.js

added schema changes for LCR (#150)

2023-05-05 20:09:34 -04:00

model.js

Fix SQL Injection Vulnerabilities (#134)

2023-03-29 12:36:51 -04:00

password-settings.js

Dh password settings (#72)

2022-10-23 14:11:00 -04:00

permissions.js

Feat/371 view only user implementation using user_permissions (#381)

2025-04-01 09:29:06 -04:00

phone-number.js

support fetching application with pagination (#450)

2025-05-28 07:28:48 -04:00

predefined-carrier.js

add retell to predefined-carriers (#545)

2026-02-24 12:50:49 -05:00

product.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

sbc.js

add support for sbc_addresses and ms_teams_tenants tables

2020-04-20 11:44:49 -04:00

service-provider-limits.js

Feature/sp call limits (#63)

2022-09-20 22:55:28 +02:00

service-provider.js

added schema changes for LCR (#150)

2023-05-05 20:09:34 -04:00

sip-gateway.js

add new fieds for ICE and DTLS (#538)

2026-01-29 13:42:07 -05:00

smpp-gateway.js

handle adding predefined carriers with smpp gateways

2021-09-09 15:38:33 -04:00

smpp.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

speech-credential.js

feat/982: fixed issue where vendor's API is not called if vendor is defined at service provider level, and also made format of name consistent (#365)

2024-12-12 17:06:45 -05:00

system-information.js

added private_newtwork_cidr to system_information table (#341)

2024-08-18 12:49:06 -04:00

tenant.js

fix(security): add authorization checks to prevent cross-account access (CWE-639) (#558)

2026-06-27 15:53:51 -04:00

user-permissions.js

Feat/371 view only user implementation using user_permissions (#381)

2025-04-01 09:29:06 -04:00

user.js

return account name and sp name in getUsers (#87)

2022-12-19 15:05:35 -05:00

voip-carrier.js

fixed filter for carriers for an account (#460)

2025-05-30 07:24:55 -04:00

webhook.js

revamp db - refactor webhooks

2020-01-28 10:30:07 -05:00