Ya3Raj

توجد مشكلة في فقدان المصادقة في مسار معلومات البيانات الوصفية المجمعة في `utils.controller.ts`. يسمح هذا للمهاجمين غير المصرح لهم بالوصول إلى البيانات الوصفية على مستوى المثيل من خلال طلب نقطة النهاية. تشمل المعلومات المكشوفة تعداد القواعد، وأعداد المستخدمين، وأعداد العروض المشتركة والمحمية بكلمة مرور، وأعداد الويب هوك، وأعداد الصفوف المباشرة لكل قاعدة. بالإضافة إلى ذلك، يمكن أن تؤدي الطلبات المتكررة إلى نقطة النهاية هذه إلى زيادة حمل استعلامات قاعدة البيانات.

The `get-comment-threads`, `get-comment-thread`, and `get-comments` RPC commands use the `check-comment-permissions!` function but fail to apply restrictions related to page-scoped share links. This allows a user with a page-scoped share link to retrieve comment threads and full comment bodies from other pages within the same file. The exposed information includes commenter names, email addresses, photos, and page identifiers. Furthermore, these page identifiers can be used with page-reading functionality to access design content that has not been shared.

An issue exists in the `delete-team-member` RPC where a team administrator can remove any member except themselves, but the system fails to protect the team owner. This allows a non-owner administrator to delete the owner's `team-profile-rel` membership, effectively locking the owner out of the team and all associated projects, files, fonts, and media.

Insufficient HTML-escaping of the `employee num` field in the acceptance PDF generator allows users with `users.edit` permissions to inject `img` tags into the `writeHTML()` function of TCPDF. This can be exploited to trigger server-side requests to internal services, cloud metadata endpoints, or external targets when a victim signs an asset acceptance. This issue leads to Server-Side Request Forgery (SSRF), a condition where the server is coerced into making requests to an unintended location.

A stored cross-site scripting issue exists in the `formattedNameLink()` function within `DepartmentPresenter`. This occurs because department names are rendered without proper escaping in the fallback branch for users lacking the `departments.view` permission. An attacker with `departments.edit` permission can inject malicious scripts into department names, which then execute in the browsers of all department members when they access the My Assets page.