{"push_id":904266084,"size":1,"distinct_size":1,"ref":"refs/heads/master","head":"3b388152887a2057e47852e962c4be8902248c49","before":"df114f40a8049ae2e4de9aa2ef4525471e8acb79","commits":[{"sha":"3b388152887a2057e47852e962c4be8902248c49","author":{"email":"b3f594e10a9edcf5413cf1190121d45078c62290@instructure.com","name":"Jeremy Stanley"},"message":"scope channel_id to calling user in notification preferences\n\ntest plan:\n 1. identify a \"victim\" user's communication channel ID\n    (for example, by creating a communication channel such as\n     SMS as watching the id returned via the browser\n     debugging tool network tab)\n 2. as an \"attacker\" user, in Firefox, open the network\n    tab in the browser debugging tools, and then go to\n    Notification Preferences in Canvas and set a preference\n    for a notification (for example, set Due Date to ASAP)\n 3. in the network tab, click the \"communication_update\"\n    AJAX request and click \"Edit and Resend\"\n 4. change the channel_id to the victim's communication channel\n    id from step 1 and click Send\n 5. the edited AJAX call should fail with a 404 (because\n    _you_ don't have a communication channel with that id)\n\nfixes CNVS-25779\n\nChange-Id: I1aa94f84ed2df6c3a3d97d16add169ac0fe44694\nReviewed-on: https://gerrit.instructure.com/68713\nReviewed-by: Simon Williams <simon@instructure.com>\nQA-Review: Clare Strong <clare@instructure.com>\nTested-by: Jenkins\nProduct-Review: Jeremy Stanley <jeremy@instructure.com>","distinct":true,"url":"https://api.github.com/repos/instructure/canvas-lms/commits/3b388152887a2057e47852e962c4be8902248c49"}]}