Andras Bacsai 3987f97a8e fix(subscription): require team admin for billing actions ...

Subscription actions ran on the session team without a role check. A user
who switched the session to a team where they are only a member could
cancel, refund, or change that team's subscription.

- Lock the team id at mount and require admin or owner of that team
- Check the locked team and the role again in every billing action
- Reject actions after the session switched to another team

2026-10-05 17:04:05 +02:00

..

Actions.php

fix(subscription): require team admin for billing actions

2026-10-05 17:04:05 +02:00

Index.php

fix(stripe): prevent duplicate subscription checkouts (#11666)

2026-09-07 20:25:06 +02:00

PricingPlans.php

fix(stripe): prevent duplicate subscription checkouts (#11666)

2026-09-07 20:25:06 +02:00

Show.php

Revert "rector: arrrrr"

2025-01-07 15:31:43 +01:00