Files
windmill/backend/windmill-api-groups
Ruben Fiszel 383c70523b fix(folders): allow dots and at-signs in folder owner validation (#9856)
Folder owners use the format u/<username>, and usernames are frequently
email addresses containing `.` and `@`. The folder creation path bypasses
validate_owner(), so these owners get inserted successfully, but add_owner
and remove_owner both call validate_owner() and rejected any later
modification of email-style owners.

Extend the character allowlist to accept `.` and `@` (and update the error
message). SQL injection risk is already mitigated by the bind-parameter
queries introduced alongside this validation.

Fixes WIN-2116

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-01 12:49:36 +02:00
..