Exclude password-protected pastes from public listings (#65) #71

Closed
poslop wants to merge 0 commits from issue-65-listing-leak into main
Owner

Fixes #65. /api/public no longer exposes password-protected pastes; password_hash IS NULL filter added to ListPublic and its count query at the query level, matching history-page visibility rules. Regression test creates a password-protected and an unlisted paste and asserts neither appears in /api/public.

Fixes #65. /api/public no longer exposes password-protected pastes; password_hash IS NULL filter added to ListPublic and its count query at the query level, matching history-page visibility rules. Regression test creates a password-protected and an unlisted paste and asserts neither appears in /api/public.
poslop added 1 commit 2026-09-09 14:13:26 +00:00
Exclude password-protected pastes from public listings (#65)
CI / docker (pull_request) Skipped
CI / test (pull_request) Successful in 20s
f6c4342468
ListPublic and its COUNT query now filter password_hash IS NULL, so
/api/public (and any page backed by it) no longer leaks metadata
(title, slug, existence) of password-protected pastes. Unlisted
pastes were already excluded. Adds regression test covering both.
Author
Owner

Fix content (f6c4342: password_hash IS NULL filter on ListPublic + regression test) is verified present on main. Merging the PR via the API kept returning "Please try again later" (server-side issue, other PRs merged fine), so this was closed manually with the fix confirmed landed.

Fix content (f6c4342: `password_hash IS NULL` filter on ListPublic + regression test) is verified present on main. Merging the PR via the API kept returning "Please try again later" (server-side issue, other PRs merged fine), so this was closed manually with the fix confirmed landed.
poslop closed this pull request 2026-09-09 14:29:53 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.