Fix cross-user job history leak

2026-04-11 17:05:52 +02:00
parent 41595605b9
commit 811963749e
4 changed files with 227 additions and 0 deletions
@@ -1676,6 +1676,9 @@ Canonical profile:
        [HttpGet("{id:int}/history")]
        public async Task<ActionResult<List<JobEventDto>>> GetHistory([FromRoute] int id, CancellationToken cancellationToken)
        {
+            var exists = await _db.JobApplications.AnyAsync(j => j.Id == id, cancellationToken);
+            if (!exists) return NotFound();
+
            var items = await _db.JobEvents
                .AsNoTracking()
                .Where(e => e.JobApplicationId == id)