gilesb 87ff3d5d14 Remove owner filtering from recipe listing (security fix) ...

The owner field from recipe content could be spoofed to hide recipes
from users or make recipes appear to belong to someone else.

For L1, all recipes in cache are now visible to authenticated users.
Ownership tracking should use the naming service or cache metadata,
not untrusted data from recipe content.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2026-01-12 15:33:39 +00:00

..

repositories

Add modular app structure for L1 server refactoring

2026-01-11 07:08:08 +00:00

routers

Fix clear-data missing username arg for discard_run

2026-01-12 15:02:09 +00:00

services

Remove owner filtering from recipe listing (security fix)

2026-01-12 15:33:39 +00:00

templates

Add pagination and API improvements

2026-01-12 14:22:09 +00:00

__init__.py

Add effects upload endpoint

2026-01-12 06:37:24 +00:00

config.py

Fix CACHE_DIR default path mismatch across files

2026-01-11 08:14:39 +00:00

dependencies.py

Fix recipe listing, effects count, and add nav counts to all pages

2026-01-12 13:30:11 +00:00

types.py

Fix item visibility bugs and add effects web UI

2026-01-12 12:01:54 +00:00