fix: prevent loading script by hash if not permissioned

backend/windmill-api/openapi.yaml

@@ -5090,6 +5090,10 @@ paths:
           in: query
           schema:
             type: boolean
+        - name: authed
+          in: query
+          schema:
+            type: boolean
       responses:
         "200":
           description: script details

backend/windmill-api/src/scripts.rs

@@ -1490,13 +1490,23 @@ async fn get_script_by_hash_internal<'c>(
     Ok(script)
 }
 
+#[derive(Deserialize)]
+struct GetScriptByHashQuery {
+    authed: Option<bool>,
+}
 async fn get_script_by_hash(
     Extension(db): Extension<DB>,
+    Extension(user_db): Extension<UserDB>,
     Path((w_id, hash)): Path<(String, ScriptHash)>,
     Query(query): Query<WithStarredInfoQuery>,
+    Query(query_auth): Query<GetScriptByHashQuery>,
     Extension(authed): Extension<ApiAuthed>,
 ) -> JsonResult<ScriptWithStarred> {
-    let mut tx = db.begin().await?;
+    let mut tx = if query_auth.authed.is_some_and(|x| x) {
+        user_db.begin(&authed).await?
+    } else {
+        db.begin().await?
+    };
     let r = get_script_by_hash_internal(
         &mut tx,
         &w_id,

frontend/src/routes/(root)/(logged)/scripts/get/[...hash]/+page.svelte

@@ -179,17 +179,23 @@
 			script = await ScriptService.getScriptByHash({
 				workspace: $workspaceStore!,
 				hash,
-				withStarredInfo: true
+				withStarredInfo: true,
+				authed: true
 			})
 			starred = script.starred
 		} catch {
-			script = await ScriptService.getScriptByPath({
-				workspace: $workspaceStore!,
-				path: hash,
-				withStarredInfo: true
-			})
-			starred = script.starred
-			hash = script.hash
+			try {
+				script = await ScriptService.getScriptByPath({
+					workspace: $workspaceStore!,
+					path: hash,
+					withStarredInfo: true
+				})
+				starred = script.starred
+				hash = script.hash
+			} catch (e) {
+				sendUserToast('Could not load script: ' + e.body, true)
+				return
+			}
 		}
 		can_write =
 			script.workspace_id == $workspaceStore &&