Marco A e6b5f559f0 fix: Force v2 permission checks on user listing ...

# Which Problems Are Solved

When the feature flag for enabling permission checks v2 is disabled, a user without permission could list users across instances and get the total number of users available.

# How the Problems Are Solved

Disregard the state of the feature flag and always enforce permission checks v2 on v2 APIs.

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
(cherry picked from commit 826039c620)

(cherry picked from commit 0e17d0005a)

2025-12-10 16:31:12 +01:00

..

actions

fix(loginV1): disable org metadata triggers (#10454)

2025-08-12 10:53:16 +02:00

activity

…

admin/repository/eventsourcing

fix(eventstore): use decimal, correct mirror (#9916)

2025-05-27 17:13:17 +02:00

api

fix: Force v2 permission checks on user listing

2025-12-10 16:31:12 +01:00

auth/repository

fix(login): only allow previously authenticated users on select account page

2025-08-21 09:04:24 +02:00

auth_request/repository

fix: cleanup information in logs (#10634)

2025-09-11 15:03:27 +02:00

authz

fix: check for 2fa even if not enforced

2025-10-29 10:38:10 +01:00

cache

perf(cache): use redis unlink for key deletion (#10658)

2025-09-10 07:53:53 +02:00

command

fix: respect lockout policy on password change (with old password) and add tar pit for checks

2025-10-29 10:34:23 +01:00

config

fix: respect lockout policy on password change (with old password) and add tar pit for checks

2025-10-29 10:34:23 +01:00

crypto

feat: generate webkeys setup step (#10105)

2025-08-21 09:14:17 +02:00

database

fix: correctly escape backslash in queries (#10522)

2025-08-21 08:32:24 +02:00

domain

fix: check for 2fa even if not enforced

2025-10-29 10:38:10 +01:00

eventstore

fix(projections): handle reduce error by updating failed events (#10726)

2025-09-16 08:44:12 +02:00

execution

perf(actionsv2): execution target router (#10564)

2025-09-10 07:53:53 +02:00

feature

fix: query organization directly from event store (#10463)

2025-08-12 11:46:15 +02:00

form

…

i18n

…

iam

…

id

chore!: Introduce ZITADEL v3 (#9645)

2025-04-02 16:53:06 +02:00

idp

fix(saml): use transient mapping attribute when nameID is missing in saml response (#10353)

2025-08-08 10:59:05 +02:00

integration

chore: use postgres 17 (#10797)

2025-10-29 12:56:04 +01:00

logstore

…

migration

…

net

…

notification

fix: sanitize host headers before use

2025-10-29 10:24:31 +01:00

org

…

project

…

protoc

chore: update dependencies (#9784)

2025-05-21 13:52:42 +02:00

qrcode

…

query

fix: Force v2 permission checks on user listing

2025-12-10 16:31:12 +01:00

queue

fix: correct river otel metrics units (#10425)

2025-09-11 15:05:55 +02:00

renderer

chore: Replace deprecated io/ioutil functions with recommended alternatives (#9542)

2025-03-17 13:17:14 +00:00

repository

fix(actions v2): send event_payload on event executions again (#10651)

2025-09-11 15:07:13 +02:00

static

fix: prevent intent token reuse and add expiry

2025-05-02 13:52:28 +02:00

statik

…

telemetry

fix: drop default otel scope info from metrics (#10306)

2025-08-15 10:32:42 +02:00

test

feat: list users scim v2 endpoint (#9187)

2025-01-21 13:31:54 +01:00

user

feat: federated logout for SAML IdPs (#9931)

2025-05-23 14:59:34 +02:00

v2

fix(cache): prevent org cache overwrite by other instances (#10012)

2025-06-03 14:56:55 +02:00

view/repository

…

webauthn

fix: sanitize host headers before use

2025-10-29 10:24:31 +01:00

zerrors

feat: create user scim v2 endpoint (#9132)

2025-01-09 12:46:36 +01:00