Dave Horton bff9314622 fix(security): add authorization checks to prevent cross-account access (CWE-639) (#558) ...

- Add precondition support to decorate.js retrieve function
- Fix google-custom-voices.js typo and add delete precondition
- Check ownership via speech_credential for google-custom-voices
- Add retrieve/delete preconditions to lcr-carrier-set-entries.js
- Add retrieve precondition to sip-gateways.js and smpp-gateways.js
- Add scope check to lcr-routes.js custom GET handler
- Add full authorization to tenants.js for all CRUD operations
- Add scoped query methods to tenant model

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

2026-06-27 15:53:51 -04:00

..

account-test.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

accounts.js

allow startrecording without siprec url for cloud (#530)

2026-01-29 18:21:31 -05:00

activation-code.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

add-from-predefined-carrier.js

Fix SQL Injection Vulnerabilities (#134)

2023-03-29 12:36:51 -04:00

alerts.js

fix query sp alerts & bump time-series (#547)

2026-03-30 10:25:45 -04:00

api-keys.js

update to uuid@8.3.2

2022-02-01 20:42:10 -05:00

appenv.js

Feat/app env vars (#430)

2025-05-08 08:41:50 -04:00

applications.js

Fix/526 (#528)

2025-12-19 07:32:20 -05:00

availability.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

beta-invite-codes.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

change-password.js

Improved invalidation of JWT in redis (#139)

2023-03-31 16:19:34 -04:00

charges.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

clients.js

encrypt client password and fix upgrade db script (#188)

2023-06-15 20:46:22 -04:00

decorate.js

fix(security): add authorization checks to prevent cross-account access (CWE-639) (#558)

2026-06-27 15:53:51 -04:00

error.js

Fix SQL Injection Vulnerabilities (#134)

2023-03-29 12:36:51 -04:00

forgot-password.js

logging

2025-08-13 20:33:40 -04:00

google-custom-voices.js

fix(security): add authorization checks to prevent cross-account access (CWE-639) (#558)

2026-06-27 15:53:51 -04:00

index.js

Feat/app env vars (#430)

2025-05-08 08:41:50 -04:00

invite-codes.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

invoices.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

lcr-carrier-set-entries.js

fix(security): add authorization checks to prevent cross-account access (CWE-639) (#558)

2026-06-27 15:53:51 -04:00

lcr-routes.js

fix(security): add authorization checks to prevent cross-account access (CWE-639) (#558)

2026-06-27 15:53:51 -04:00

lcrs.js

fix create update lcr generate too much request (#259)

2023-11-14 08:07:04 -05:00

limits.js

extend sid validation to all routes (#138)

2023-03-31 07:46:33 -04:00

login.js

fix: reject if user.provider !== local when login (#408)

2025-04-09 09:53:24 -04:00

logout.js

Improved invalidation of JWT in redis (#139)

2023-03-31 16:19:34 -04:00

password-settings.js

Add passwordSettings validation (#136)

2023-03-29 08:54:05 -04:00

phone-numbers.js

Feat/admin numbers carriers (#532)

2026-01-07 08:01:44 -05:00

predefined-carriers.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

prices.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

products.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

recent-calls.js

Update recent-calls.js (#549)

2026-04-14 08:19:42 -04:00

register.js

remove activation code from response (#513)

2025-11-12 13:13:09 -05:00

sbcs.js

fix sp user cannot fetch sbcs (#195)

2023-06-29 11:06:59 +01:00

service-providers.js

Fix API for Carriers & SIP Gateways (#492)

2025-08-28 08:46:42 -04:00

signin.js

remove unnecessary await (#152)

2023-04-18 13:01:38 -04:00

sip-gateways.js

fix(security): add authorization checks to prevent cross-account access (CWE-639) (#558)

2026-06-27 15:53:51 -04:00

sip-realm.js

bug: attempting to add duplicate dns records on hosted system (#312)

2024-04-19 18:13:27 -04:00

smpp-gateways.js

fix(security): add authorization checks to prevent cross-account access (CWE-639) (#558)

2026-06-27 15:53:51 -04:00

smpps.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

sms-inbound.js

replace bent by native node fetch (#401)

2025-04-24 06:50:15 -04:00

sms-outbound.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

speech-credentials.js

fix microsoft SST endpoint id is failed on validating speech credential (#554)

2026-06-01 08:38:21 -04:00

stripe-customer-id.js

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

subscriptions.js

cannot fetch voice_call_session (#525)

2025-12-17 07:27:01 -05:00

system-information.js

fix admin setting issue (#168)

2023-05-11 20:27:19 -04:00

tenants.js

fix(security): add authorization checks to prevent cross-account access (CWE-639) (#558)

2026-06-27 15:53:51 -04:00

tts-cache.js

api server cannot synthesize text after upgrade latest speech-utils (#317)

2024-04-29 19:48:34 -04:00

users.js

Update users.js (#474)

2025-06-27 07:13:14 -04:00

utils.js

fix unhandled exception (#473)

2025-06-26 13:09:42 -04:00

voip-carriers.js

Fix/carrier entry data (#542)

2026-02-09 10:40:59 -05:00

webhooks.js

fix small issues in the code (#145)

2023-04-06 07:31:14 -04:00