mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-18 16:02:10 +00:00
383c70523b
Folder owners use the format u/<username>, and usernames are frequently email addresses containing `.` and `@`. The folder creation path bypasses validate_owner(), so these owners get inserted successfully, but add_owner and remove_owner both call validate_owner() and rejected any later modification of email-style owners. Extend the character allowlist to accept `.` and `@` (and update the error message). SQL injection risk is already mitigated by the bind-parameter queries introduced alongside this validation. Fixes WIN-2116 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>