Fix: Unauthenticated access to customer order confirmation PDFs via /ftp - #365

Closed

WesternConcrete wants to merge 4 commits into

devin/1789370006-order-pdf-owner-check-develop

GitHub Advanced Security / CodeQL failed Sep 14, 2026 in 4s

4 new alerts including 4 high severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

4 high

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 57 in lib/insecurity.ts

Code scanning / CodeQL

User-controlled bypass of security check High

This condition guards a sensitive

, but a

controls it.
This condition guards a sensitive

, but a

controls it.
This condition guards a sensitive

, but a

controls it.
This condition guards a sensitive

, but a

controls it.
This condition guards a sensitive

, but a

controls it.

Check failure on line 29 in routes/fileServer.ts

Code scanning / CodeQL

User-controlled bypass of security check High

This condition guards a sensitive

, but a

controls it.
This condition guards a sensitive

, but a

controls it.
This condition guards a sensitive

, but a

controls it.

Check failure on line 78 in routes/fileServer.ts

Code scanning / CodeQL

User-controlled bypass of security check High

This condition guards a sensitive

, but a

controls it.

Check failure on line 84 in routes/fileServer.ts

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a

.