Ernest Hysa 3738df3b93 fix(tasks): validate then_task_id belongs to same owner on create/update (#2764) ...

then_task_id was stored without checking the target task's owner. A user
could chain their task to execute any other user's task on success via the
scheduler's _run_chained path. Now verifies the target task exists and
belongs to the requesting user before storing.

2026-06-05 15:12:47 +02:00

50 KiB

Raw Blame History

View Raw