# Which Problems Are Solved
URL encoded paths were not correctly checked in the auth handler and computing the necessary path prefix would break.
# How the Problems Are Solved
- Pass the path prefix instead of computing it and fully rely on the path template in case the exact path was not found in the check.
# Additional Changes
None
# Additional Context
- requires backport to v4.x and v3.x
(cherry picked from commit 4a8a5e2fef)
# Which Problems Are Solved
Some endpoints in the management API verified the user's permission but did not honor the organization the permission was granted in the internal process. This led to cross-tenant information disclosure.
The following endpoints were affected:
* `GetProjectByID`
* `GetGrantedProjectByID`
* `GetProjectGrantByID`
* `GetAppByID`
* `ListApps`
* `ListHumanAuthFactors`
* `ListHumanPasswordless`
# How the Problems Are Solved
Correctly treat the requested context (organization) where the permission was granted and use that to query the resource.
# Additional Changes
None
# Additional Context
- requires backport to v4.x and v3.x
(cherry picked from commit ab51fd9563)
(cherry picked from commit da227a458a)
# Conflicts:
# internal/query/app.go
# Which Problems Are Solved
User are allowed to change their own data including email and phone. However, they were unintentionally able to also set them to verified without according permission.
# How the Problems Are Solved
Fix self-management of email and phone and disallow setting them to verified without according permission.
# Additional Changes
None
# Additional Context
- requires backport to v4.x and v3.x
(cherry picked from commit 0261536243)
(cherry picked from commit 288f064e3c)
Livio Spring