Files
WebForm-mw/app/api
Joel Brock c9b610590e Fail closed in verifyChecksum; drop the Contact.get fallback
If Contact.validateChecksum threw for any reason, verifyChecksum retried
with Contact.get plus an unknown `checksum` param. Our API key is
privileged, so if Civi ever ignored that param the probe would resolve
the contact and accept any checksum. Treat errors as invalid instead,
and reject non-positive/non-integer contact ids up front.
2026-10-30 11:17:52 -07:00
..