Marcel 8fc360a596 fix(admin): guard GET /api/users/{id} with @RequirePermission(ADMIN_USER) ...

Fixes IDOR: the endpoint was publicly accessible to any authenticated user.
Now requires ADMIN_USER permission, matching all other user management endpoints.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-30 01:09:40 +02:00

..

.mvn/wrapper

build: add mvn properties

2026-03-17 13:33:02 +00:00

api_tests

restructure: flatten workspace nesting, move devcontainer to root

2026-03-15 11:47:58 +01:00

src

fix(admin): guard GET /api/users/{id} with @RequirePermission(ADMIN_USER)

2026-03-30 01:09:40 +02:00

.gitignore

restructure: flatten workspace nesting, move devcontainer to root

2026-03-15 11:47:58 +01:00

Dockerfile

fix(backend): switch base image from alpine to debian for bash compatibility

2026-03-19 12:03:14 +01:00

HELP.md

restructure: flatten workspace nesting, move devcontainer to root

2026-03-15 11:47:58 +01:00

mvnw

restructure: flatten workspace nesting, move devcontainer to root

2026-03-15 11:47:58 +01:00

mvnw.cmd

build: add mvn properties

2026-03-17 13:33:02 +00:00

pom.xml

fix(notifications): clamp size param to max 100 on GET /api/notifications

2026-03-29 19:12:14 +02:00