Juan Fernandez
b06cbde1de
The host transfer endpoint recorded raw requested host IDs in the transferred_hosts activity verbatim, letting an authorized user inject fabricated IDs into the audit trail. Derive the activity's host IDs and names only from hosts that actually exist, and skip the activity when none exist.
2 lines
288 B
Plaintext
2 lines
288 B
Plaintext
- Fixed the host transfer activity (`transferred_hosts`) to only record host IDs that actually exist, so non-existent host IDs passed to `POST /api/latest/fleet/hosts/transfer` can no longer be injected into the audit trail. No activity is created when none of the requested hosts exist.
|