Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

itflow-org/itflow

              master @ 0262707
            

147

Fixes

CVEs

CRITICAL

Peak severity

35.1%

Coverage

Highlights

CSRF: 51 prior fixes. Scrutinize any change in this area.

post.php: most-fixed (10 issues). Treat as high-risk during review.

106 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

CSRF: The largest single vulnerability class with over 50 fixes; many state-changing operations lacked CSRF tokens, and several fixes note tokens were added 'before permission checks' or were missing on GET-based delete/export actions.

Access Control / Broken Access Control: Multiple fixes added enforceClientAccess(), enforceUserPermission(), and apiClientScopeSql() to prevent cross-client data exposure. The API key scoping was replaced with user-based RBAC, and many modal/global search paths lacked permission checks.

SQL Injection: 13 fixes show unescaped user input reaching mysqli_query, including in date filters, search parameters, status arrays, and password hashes. Several were fixed with intval() or mysqli_real_escape_string.