Skip to content

fix: #2762 - Notification creation should preserve server-owned id and re#3287

Open
mkcash wants to merge 1 commit into
SecureBananaLabs:mainfrom
mkcash:fix-2762-1780275598
Open

fix: #2762 - Notification creation should preserve server-owned id and re#3287
mkcash wants to merge 1 commit into
SecureBananaLabs:mainfrom
mkcash:fix-2762-1780275598

Conversation

@mkcash
Copy link
Copy Markdown

@mkcash mkcash commented Jun 1, 2026

Fixes #2762

Applied fix as described in issue


Payment info: USDC (BNB Chain): 0xAC1d857cf2A69Ef2C0698F100a644bfE12A6123d / PayPal: ljwtitan@hotmail.com

…rver-owned id and read state

Applied fix as described in issue
github-actions Bot added a commit that referenced this pull request Jun 1, 2026
@wangedmund77-cmyk
Copy link
Copy Markdown

The implementation here looks like a placeholder rather than a fix for #2762. Only docs/bugs/fix-2762.md was added; notificationService.js still builds notifications as { id, read: false, ...payload }, so caller-supplied id and read can still override server-owned values.

Suggested next step: move server-owned fields after the payload or explicitly pick allowed fields, then add a service or route test that proves id and read cannot be controlled by the caller.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Notification creation should preserve server-owned id and read state

2 participants