fleet/changes/16773-query-pack-metadata-leak at imgbot - fleet - Gitea: Git with a cup of tea

Discharge7443/fleet

Files

T

Lucas Manuel Rodriguez 1397531199 Authorize packs before returning them in query responses (#50148 )

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Query responses now include pack details only when the requester has
permission to view them.
* Prevented pack metadata from being disclosed across fleets when query
names overlap.
* Corrected target selection labels and empty-state messaging for
fleet-based targets.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

2026-07-29 13:35:47 -03:00

2 lines

225 B

Plaintext

Raw Permalink Blame History

- Fixed query (report) responses so that pack metadata (ID, name, description) is only included when the requesting user is authorized to read packs, preventing cross-fleet pack metadata disclosure via query name collisions.