Skip to content

Protect private project activity - #371

Merged
Cannonb4ll merged 2 commits into
ploi:mainfrom
bjarn:codex/fix-private-project-activity
Oct 5, 2026
Merged

Cannonb4ll merged 2 commits into
ploi:mainfrom
bjarn:codex/fix-private-project-activity

Conversation

@bjarn

@bjarn bjarn commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Apply item visibility checks to the activity page, recent activity, and activity widget.
  • Exclude private comments from activity queries.
  • Count only public comments in activity output.
  • Add regression tests for private projects and private note counts.

Security impact

Activity feeds could disclose private project item metadata and private note counts.

Tests

  • php artisan test --compact tests/Feature/Livewire/ActivityTest.php tests/Feature/Livewire/Welcome/RecentActivityTest.php tests/Feature/Widget/WidgetTest.php

@Cannonb4ll
Cannonb4ll merged commit df3a1bf into ploi:main Oct 5, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants