m038andClaude Opus 4.8
4e91492f65
Enforce R6 on the save path (KTD6): in cache-on-save's onFormValidationProcessed, when a hidden edit_path is present, require the site owner (not merely any login — the super-admin tester also authenticates) AND that the target resolves through the page tree to a direct child of the active trip's dailies container. Fail closed with a ValidationException so add_page never runs. Create (empty edit_path) is left untouched. New shared EntryScopeGuard (classes/EntryScopeGuard.php) is the single source of truth for both R6 enforcement points — this save guard and U6's delete route call the same isOwner()/resolveActiveDailyChild()/segment helpers, so they cannot diverge (KTD5). Resolution is via $pages->find() + a parent-route assertion, never raw path concatenation, closing the traversal hole (basename(dirname()) yields the same target add-page-by-form writes to). Verified on the 2.0.4 container: non-owner edit, out-of-scope edit_path, unsafe '..' segment, and non-dailies-child targets are all rejected; owner in-place edit succeeds (V3). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H1FrCYNq6RXdGYbn5PFrhM