Issues - tinker_tickets - Lotus Git Server

LotusGuild/tinker_tickets

Labels Milestones New Issue

DB connection failure leaks raw mysqli error text to any unauthenticated visitor priority/medium security

by jared was closed 2026-09-11 11:54:45 -04:00

Image attachments retain EXIF metadata (including GPS location) — served back verbatim to any user with ticket access priority/medium security

by jared was closed 2026-09-08 20:46:43 -04:00

LDAP bind credentials transmitted in plaintext (no TLS) priority/medium security

by jared was closed 2026-09-12 01:02:18 -04:00

TRUSTED_PROXIES ships empty/disabled by default — full admin-impersonation risk if not explicitly configured config priority/high security

by jared was closed 2026-09-11 11:54:45 -04:00

12 of ~16 hand-rolled CSRF checks omit csrf_token from their rejection response, breaking client-side resync app-wide priority/high security

by jared was closed 2026-09-11 11:54:45 -04:00

Bearer API endpoints are rate-limited purely by shared IP, not by API key — one key can starve another priority/medium rate-limiting security

by jared was closed 2026-09-11 14:12:00 -04:00

Watchers are never pruned when a ticket's visibility is tightened notifications priority/medium security

by jared was closed 2026-09-11 13:48:32 -04:00

sendAssignmentNotification() has the same missing-visibility-check gap as #46 notifications priority/medium security

by jared was closed 2026-09-11 11:27:08 -04:00

notifyWatchers() only half-redacts for non-public tickets — title and shared notify-list still leak notifications priority/medium security

by jared was closed 2026-09-11 11:27:07 -04:00

Bearer read-scope API keys bypass ticket visibility entirely — confirm this is an intentional, documented decision needs-decision priority/high security

by jared was closed 2026-09-12 01:21:14 -04:00

@mention notifications leak confidential/internal ticket content to users with no access — worse than #46 notifications priority/high security

by jared was closed 2026-09-11 11:27:07 -04:00

hwmonDaemon 'reopen closed duplicate' path bypasses Workflow Designer validation entirely via raw SQL priority/high security workflow

by jared was closed 2026-09-11 12:44:17 -04:00

Stale sessions never re-sync privileges from Authelia (revoked admin keeps access up to 5h) priority/high security

by jared was closed 2026-09-11 12:24:00 -04:00

No per-ticket or per-user attachment count/storage quota priority/low security

by jared was closed 2026-09-08 20:46:38 -04:00

Custom field values have no server-side validation against field_type or select options priority/medium security

by jared was closed 2026-09-11 13:48:31 -04:00

api/notifications.php: in-app notifications don't re-check current ticket visibility notifications priority/medium security

by jared was closed 2026-09-11 13:48:31 -04:00

Confidential/internal ticket titles leak to Matrix on create/status-change (NotificationHelper missing visibility check) notifications priority/high security

by jared was closed 2026-09-11 11:27:06 -04:00

base.js: unused lt.markdown module has no URL-protocol allowlist on links — latent stored-XSS trap dead-code priority/low security

by jared was closed 2026-09-11 15:20:22 -04:00

api/get_users.php: unrestricted user enumeration, no pagination or admin gate priority/low security

by jared was closed 2026-09-08 20:46:36 -04:00

13 of 33 API endpoints never disable display_errors — potential stack-trace leak priority/medium security

by jared was closed 2026-09-11 12:23:59 -04:00

1 2