Classic298 a66477b710 fix: bind channel thread parent/reply to the URL channel (#25766) ...

GET /api/v1/channels/{id}/messages/{message_id}/thread authorized only the URL channel, but get_messages_by_parent_id() appended the thread parent (loaded by id) without checking it belonged to that channel, so a caller could read a message from a channel they cannot access by passing its id as the thread root. Require the parent to be in the requested channel before returning it, and reject a posted parent_id/reply_to_id that does not belong to the channel.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-29 03:46:50 -05:00

..

access_grants.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

auths.py

refac

2026-06-29 03:16:59 -05:00

automations.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

calendar.py

refac

2026-06-01 14:09:54 -07:00

channels.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

chat_messages.py

refac

2026-06-23 23:35:44 +02:00

chats.py

refac

2026-06-29 01:38:41 -05:00

config.py

refac

2026-06-18 11:02:14 +02:00

feedbacks.py

refac

2026-06-17 00:17:48 +02:00

files.py

feat(ui): show total file count in FilesModal title (#25873)

2026-06-17 02:55:13 +02:00

folders.py

refac

2026-06-17 00:25:35 +02:00

functions.py

chore: format

2026-06-01 13:56:55 -07:00

groups.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

knowledge.py

refac

2026-06-29 01:41:43 -05:00

memories.py

refac

2026-06-29 00:26:35 -05:00

messages.py

fix: bind channel thread parent/reply to the URL channel (#25766)

2026-06-29 03:46:50 -05:00

models.py

refac

2026-06-29 02:43:14 -05:00

notes.py

refac

2026-05-14 01:49:34 +09:00

oauth_sessions.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

prompt_history.py

fix: bind prompt history/version ops to the authorized prompt (#25056)

2026-06-01 12:07:52 -07:00

prompts.py

chore: format

2026-06-01 13:56:55 -07:00

shared_chats.py

feat(ui): add 'Unshare All Shared Chats' button to Shared Chats modal (#25848)

2026-06-17 03:06:41 +02:00

skills.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

tags.py

chore: format

2026-06-01 13:56:55 -07:00

tools.py

solve-valves-icon-disappear-issue (#26256)

2026-06-29 00:56:44 -05:00

users.py

chore: format

2026-06-01 13:56:55 -07:00