Fixes#65. /api/public no longer exposes password-protected pastes; password_hash IS NULL filter added to ListPublic and its count query at the query level, matching history-page visibility rules. Regression test creates a password-protected and an unlisted paste and asserts neither appears in /api/public.
Fixes #65. /api/public no longer exposes password-protected pastes; password_hash IS NULL filter added to ListPublic and its count query at the query level, matching history-page visibility rules. Regression test creates a password-protected and an unlisted paste and asserts neither appears in /api/public.
ListPublic and its COUNT query now filter password_hash IS NULL, so
/api/public (and any page backed by it) no longer leaks metadata
(title, slug, existence) of password-protected pastes. Unlisted
pastes were already excluded. Adds regression test covering both.
Fix content (f6c4342: password_hash IS NULL filter on ListPublic + regression test) is verified present on main. Merging the PR via the API kept returning "Please try again later" (server-side issue, other PRs merged fine), so this was closed manually with the fix confirmed landed.
Fix content (f6c4342: `password_hash IS NULL` filter on ListPublic + regression test) is verified present on main. Merging the PR via the API kept returning "Please try again later" (server-side issue, other PRs merged fine), so this was closed manually with the fix confirmed landed.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #65. /api/public no longer exposes password-protected pastes; password_hash IS NULL filter added to ListPublic and its count query at the query level, matching history-page visibility rules. Regression test creates a password-protected and an unlisted paste and asserts neither appears in /api/public.
Fix content (
f6c4342:password_hash IS NULLfilter on ListPublic + regression test) is verified present on main. Merging the PR via the API kept returning "Please try again later" (server-side issue, other PRs merged fine), so this was closed manually with the fix confirmed landed.Pull request closed