12.44.0

Bugfixes

• Object permissions are checked before the object is retrieved

  A user without permission to view objects is now refused before anything is requested from the Objecten API.

Security

• Permission checks only accept known resource types

  When Valtimo was asked whether a user may perform an action, the resource type in that question was taken at face value, which allowed any signed-in user to make the server load arbitrary internal parts of the application. Only the resource types that can be selected under Access control are accepted now, and anything else is answered as "not permitted", so normal use is unaffected.