mirror of
https://github.com/coder/coder.git
synced 2026-09-22 05:05:20 +08:00
handleProcessOutput and handleSignalProcess did not check the chat ID from the request. Any caller that knew a process ID could read output or signal processes belonging to other chats. handleListProcesses already filtered by chat ID. Apply the same check to the output and signal handlers. Non-chat callers (no Coder-Chat-Id header) are allowed through for backwards compatibility.