diff --git a/CHANGELOG.md b/CHANGELOG.md index 9cb127833..bb5f41685 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed +- Hardened the endpoint of the public access for portfolio sharing by restricting it to public accesses - Improved the language localization by translating various tooltips across the application - Upgraded `yahoo-finance2` from version `3.14.3` to `3.15.4` diff --git a/apps/api/src/app/endpoints/public/public.controller.ts b/apps/api/src/app/endpoints/public/public.controller.ts index d06e3b5fe..f43e51f7b 100644 --- a/apps/api/src/app/endpoints/public/public.controller.ts +++ b/apps/api/src/app/endpoints/public/public.controller.ts @@ -46,7 +46,10 @@ export class PublicController { public async getPublicPortfolio( @Param('accessId') accessId: string ): Promise { - const access = await this.accessService.access({ id: accessId }); + const access = await this.accessService.access({ + granteeUserId: null, + id: accessId + }); if (!access) { throw new HttpException(