Catalin Pit d568f88a71 fix: prevent recipients who already signed from rejecting documents ...

rejectDocumentWithToken never checked the recipient's signing status, so a
recipient who had already signed could still reject with their signing token,
for example from a tab opened before signing. That overwrote their status and
signedAt and cancelled the document for every other recipient.

Add the same NOT_SIGNED guard that rejectDocumentOnBehalfOf already has.

Fixes #3180

2026-09-29 12:41:28 +01:00

..

2fa

fix: improve action auth flow for passwordless users (#3358)

2026-09-11 14:17:34 +10:00

admin

feat: allow admin recipient search (#3277)

2026-08-25 11:20:11 +10:00

ai

fix: use documenso fork of skia-canvas for rendering (#3214)

2026-08-17 15:23:19 +10:00

analytics

feat: optimise posthog usage and add error tracking (#3301)

2026-08-27 11:11:51 +10:00

auth

fix: improve action auth flow for passwordless users (#3358)

2026-09-11 14:17:34 +10:00

branding

fix: remove presigned branding upload (#3053)

2026-07-02 15:51:19 +10:00

captcha

feat: add turnstile captcha to auth flow (#2703)

2026-04-16 14:29:07 +10:00

cert

fix: default unset signing transport to local (#3309)

2026-09-04 08:17:42 +10:00

crypto

fix: lint project (#2693)

2026-05-08 16:04:22 +10:00

document

fix: prevent recipients who already signed from rejecting documents

2026-09-29 12:41:28 +01:00

document-conversion

feat: support DOCX uploads via Gotenberg (#2801)

2026-05-13 15:06:21 +10:00

document-data

fix: lint project (#2693)

2026-05-08 16:04:22 +10:00

document-meta

feat: add CSC AES/QES signing (v1 instance-wide config) (#2874)

2026-06-16 23:37:34 +10:00

email

feat: add custom brand colours to emails (#3005)

2026-06-22 14:33:34 +10:00

embedding-presign

fix: add dynamic rate limits (#2892)

2026-05-31 00:34:28 +10:00

envelope

feat: add recipient grouping (#3319)

2026-09-29 16:52:43 +10:00

envelope-attachment

fix: tighten permission and validation checks (#3046)

2026-06-29 13:15:13 +10:00

envelope-item

feat: add CSC AES/QES signing (v1 instance-wide config) (#2874)

2026-06-16 23:37:34 +10:00

field

feat: add recipient grouping (#3319)

2026-09-29 16:52:43 +10:00

folder

fix: lint project (#2693)

2026-05-08 16:04:22 +10:00

htmltopdf

fix: lint project (#2693)

2026-05-08 16:04:22 +10:00

konva

fix: use documenso fork of skia-canvas for rendering (#3214)

2026-08-17 15:23:19 +10:00

license

feat: add CSC AES/QES signing (v1 instance-wide config) (#2874)

2026-06-16 23:37:34 +10:00

organisation

feat: add team document analytics dashboard (#3355)

2026-09-24 09:50:35 +10:00

pdf

fix: accept owner-password protected pdfs (#3396)

2026-09-26 11:23:33 +10:00

profile

fix: lint project (#2693)

2026-05-08 16:04:22 +10:00

public-api

feat: last used column for api tokens (#3230)

2026-08-25 18:07:31 +10:00

rate-limit

fix: improve action auth flow for passwordless users (#3358)

2026-09-11 14:17:34 +10:00

recipient

feat: add recipient grouping (#3319)

2026-09-29 16:52:43 +10:00

share

fix: tighten permission and validation checks (#3046)

2026-06-29 13:15:13 +10:00

signature-level

feat: add recipient grouping (#3319)

2026-09-29 16:52:43 +10:00

site-settings

feat: admin-configurable email blocklist (#2884)

2026-05-29 01:12:55 +10:00

stripe

feat: migrate nextjs to rr7

2025-02-13 14:10:38 +11:00

subscription

fix: add email disable flag (#2931)

2026-06-05 17:55:10 +10:00

team

feat: add team document analytics dashboard (#3355)

2026-09-24 09:50:35 +10:00

telemetry

fix: lint project (#2693)

2026-05-08 16:04:22 +10:00

template

feat: add recipient grouping (#3319)

2026-09-29 16:52:43 +10:00

user

fix: improve action auth flow for passwordless users (#3358)

2026-09-11 14:17:34 +10:00

webhooks

fix: block SSRF via IPv4-mapped IPv6 webhook URLs (#2901) (#3166)

2026-09-04 15:42:39 +10:00