2 Commits
Author SHA1 Message Date
dualfroz 43d1e8b58c fix(api): remove author email addresses from comments and activity
getComment, getAllComments, getProjectActivity, getProjectActivities and
getMyActivityStream returned the email address of the comment or event
author to any project member. Comment events also carry it in their
stored comment data.

The models keep the column since the web UI needs it for avatars, the
procedures drop it before answering.

Fixes #5876
2026-10-03 17:19:19 +02:00
dualfroz 16430fd3d2 fix(api): return a full batch response when one request is forbidden
An AccessDeniedException raised by a single request was relayed out of the
batch loop, so the whole call answered with one error object instead of the
array of responses required by the JSON-RPC spec. Authentication failures
still fail the whole call.

Fixes #3879
2026-09-11 13:43:43 -07:00