05/02/2026 updated code for security 4

app/routes/sharing.py

@@ -233,19 +233,21 @@ def accept_share(share_id):
     share.accepted = True
     share.recipient_id = user.id
 
+    # Look up owner email for the audit log before committing
+    owner = db.session.get(User, share.owner_id)
+    owner_email = owner.email if owner else f'user_id={share.owner_id}'
+
     AuditLog.log(
         user_id=g.current_user_id,
         action='shared_item.accept',
         resource_type='shared_item',
         resource_id=share.id,
-        detail=f'Accepted shared item "{share.item_name}" from {share.recipient_email}',
+        detail=f'Accepted shared item "{share.item_name}" from {owner_email}',
         ip_address=_client_ip(),
     )
     db.session.commit()
 
     d = share.to_dict()
-    owner = db.session.get(User, share.owner_id)
-    d['owner_email'] = owner.email if owner else 'Unknown'
+    d['owner_email'] = owner_email
     d['owner_public_key'] = owner.sharing_public_key if owner else None
-    return jsonify(d), 200
-
+    return jsonify(d), 200