mirror of
https://github.com/Sea-Haven-Industries/afterhours-shift-manager.git
synced 2026-09-30 10:13:11 +00:00
Adam Moussa
401a561ae2
reassign_if_held_by trusted 'no override row' as 'still the requester's', but a weekly-held shift also has no override row. An admin clear or weekly edit between swap-init and accept could move the shift to a third party with no override, letting the accept steal it (CWE-367, confirmed HIGH). Re-resolve the current holder at accept and abort if it is no longer the requester. Adds regression test + seeds the holder in existing accept tests. |
||
|---|---|---|
| .. | ||
| holiday_router | ||
| release_notifier | ||
| ring_scheduler | ||
| roster_sync | ||
| scripts | ||
| shared | ||
| slack_bot | ||
| weekly_post | ||
| conftest.py | ||
| requirements.txt | ||