comisiones/[id] generateMetadata is ungated - leaks comision name in the title to a viewer the page 404s
generateMetadata in src/app/(protected)/comisiones/[id]/page.tsx:29-33 calls getComisionHeader(id) with no getSession() and no hasCap() check, so it resolves and emits <title>M | <nombre> · Comisión</title> for a viewer the page then 404s two branches later. Observed live on v2.79.80 (dpl_A493xBkTDNwAWEwyABZZ76fMsrbr) during the MARS-744 lector walk: session proven lector (users 900eb3d8, viewAllPracticas only), navigated /comisiones/3d1154e2-651d-4262-a7bb-35168646134b, tab title read '2023 · Comisión' while <main> rendered 'Página no encontrada'. appEvents 08:07:36.398Z comision-detail-access-denied info/denied detail {"reason":"not-a-member"}. That notFound() at page.tsx:151 is commented as a deliberate no-existence-leak; the ungated metadata defeats it, letting an authed-but-unauthorized user enumerate which comisión ids exist and read their names from the title alone. Leak surface is whatever getComisionHeader returns (comisiones-teacher-view.ts:99-115): comisionName, periodoName, programaLabel, docenteCount, alumnoCount - only comisionName reaches the title today, but the ungated call is the defect, so gate the call rather than trimming the title. Contrast /alumnos/[id], which is not affected because its metadata is the static literal { title: 'Alumno' } (page.tsx:29). Suggested fix: move the cap/membership check ahead of the header read, or return the bare 'Comisión' title when the session fails it. NOT pushed by support-evolutiva-cc on purpose - v2.79.80 is the deploy under audit verdict for MARS-744 and a mid-verdict push invalidates the stamped deploy hash.
Activity
-
9d6c77f (v2.79.81) live: /api/health 2.79.81 == remote package.json, dpl_35x7c5t92vNbm4t8ZTZVLrtmTXvQ; runtime error/fatal logs 15m: none. audit-general-cc PASS:9d6c77f (static, deep). Not exercised: live re-walk as lector (title on /comisiones/3d1154e2 should read 'Comision'), copy uniformity read only from the diff. The 'Ayuda' button audit asked about exists (support-fab.tsx, mounted in the protected layout), so the copy points at a real entry point.
-
coder-mars-ca
-
Reassigned coder-mars-cc -> coder-mars-ca by support-evolutiva-cc: Elazar direct, relayed by coder-mars-cc 2026-09-19 05:39 ART (tag coder-mars-cc-mu84z5ae8oie) - coder-mars-ca replaces it as Mars coder + PM and coder-mars-cc has stopped work. coder-mars-ca verified live on the hub at reassign time. Scope of this reassignment: only the four items support-evolutiva-cc filed from the MARS-744 lector walk. The other nine open Mars items still on coder-mars-cc are flagged to coder-mars-ca and pmmaster-evolutiva-cc, not moved by me - not my lane.
-
Already fixed by 9d6c77f (live since v2.79.81; ancestor of current v2.85.11). generateMetadata now validates UUID and session, applies the same manageRoster/fullAccess/teacher-membership predicate as the page before getComisionHeader, and returns generic Comisión for denied viewers. Prior Class-A static audit PASS and deploy/runtime check are on this row. Current source comparison confirms no title/name leak on the denied branch; authenticated live lector re-walk remains unexercised. No new code change.