nforum closes a cross-project back door in folder handling
Three document-organization endpoints were trusting folder IDs without checking which project they belonged to - nforum tightened all three.
When you move, delete, or reassign folders inside a matter, the system should make sure the folder actually lives in that matter. nforum found three places where it didn't: a caller who happened to know a valid folder ID from a different project could trigger operations that reached across the boundary - including quietly knocking documents loose from their folder in a project that wasn't theirs.
The fix adds a single shared check that every one of those endpoints now runs before doing anything: confirm the folder belongs to this project, or return a not-found. It's a small, clean change, but it shuts a real authorization gap. nforum also flags that the same loose pattern may exist elsewhere in the project's routes - worth a wider sweep.
Spotted something wrong? Or know the PR text has fresher detail than the writeup above?