Sharon Katz
81f2edec65
## Summary Ensures that `SoftwareTitleByID` validates fleet scope for all non-nil `team_id` values, including zero. Previously the scope check was only applied when `team_id > 0`. ## Reproduction Added a unit test (`TestSoftwareTitleByIDTeamIDZero`) that sets up a fleet-scoped user on fleet 1, then calls `SoftwareTitleByID` with `team_id=0`. Before this change, the call succeeded. After, it correctly returns 403. Also confirmed that a global admin calling with `team_id=0` still succeeds, and that all existing `TestServiceSoftwareTitlesAuth` subtests continue to pass. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Enhanced fleet scope validation for software title lookups, including correct handling when a team scope value is set to `0`. * **Tests** * Added unit test coverage for software title retrieval authorization behavior when the team scope value is `0`. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2 lines
62 B
Plaintext
2 lines
62 B
Plaintext
- Improved fleet scope validation for software title lookups.
|