mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-21 08:02:26 +00:00
1e266a0c0a
The root job fetch at the start of get_flow_job_debug_info was missing .with_auth(&opt_authed), which left the anonymous-user access check disabled for this endpoint. Child jobs in the same handler already had the check. Unauthenticated callers holding a flow job UUID could fetch job arguments of non-anonymous jobs, including secrets passed as flow inputs. Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Windmill API
The API server, exposing functionality to other components and the frontend
This crate exposes both a library as well as a binary target.