From f4cd301f524af677a3f0a1ed9db27be806467ca8 Mon Sep 17 00:00:00 2001
From: bruno <bruno.charest@gmail.com>
Date: Tue, 14 Jul 2026 16:25:13 -0400
Subject: [PATCH] fix: _sidebar_data verifies workspace ownership before
 loading pages

- Stale numeric workspace cookie from another user now rejected
- workspace_pages only loaded if owner_id matches current user
- Prevents sidebar tree leak of other users' content
---
 app/routers/dashboard.py | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/app/routers/dashboard.py b/app/routers/dashboard.py
index b77b41e..af9f6b4 100644
--- a/app/routers/dashboard.py
+++ b/app/routers/dashboard.py
@@ -82,13 +82,19 @@ def _sidebar_data(request: Request, repos: list[dict]) -> dict:
             active_ws_name = f"{gitea_owner}/{gitea_repo}"
             gitea_workspace = True
             workspace_pages = []  # loaded client-side
-    elif ws_cookie:
-        workspace_pages = _load_workspace_pages(ws_cookie)
+    elif ws_cookie and user:
         try:
+            wsi = int(ws_cookie)
             with get_conn() as conn:
-                ws_row = conn.execute("SELECT name FROM workspaces WHERE id=?", (int(ws_cookie),)).fetchone()
-                if ws_row:
-                    active_ws_name = ws_row["name"]
+                # Verify this workspace belongs to the current user
+                row = conn.execute(
+                    "SELECT id, name, owner_id FROM workspaces WHERE id=? AND owner_id=?",
+                    (wsi, user["id"])
+                ).fetchone()
+                if row:
+                    active_ws_name = row["name"]
+                    workspace_pages = _load_workspace_pages(ws_cookie)
+                # else: stale cookie from another user — ignore
         except (ValueError, Exception):
             pass