9 Commits

Author	SHA1	Message	Date
Yamila Moreno	ddba2ffa75	📎 Update Kaleidos Copyright (#9929)	2026-05-29 11:24:58 +02:00
Andrey Antukh	8f4f948104	🐛 Skip the ssrf check on internal audit-log archive task	2026-05-11 15:22:59 +02:00
Andrey Antukh	279231240d	🐛 Harden outbound HTTP requests against SSRF and restrict assets handlers (#9390) ... * ⬆️ Update root deps * 🐛 Harden outbound HTTP requests against SSRF and restrict unauthenticated asset access - Add app.util.ssrf URL/host validator that resolves hostnames and blocks loopback, link-local, site-local, cloud metadata, and operator-supplied CIDRs - Add app.media.sanitize image EOF truncator that strips trailing data after PNG IEND, JPEG EOI, GIF trailer, and WebP RIFF markers - Disable HTTP client auto-redirect; add req-with-redirects! helper that revalidates every redirect hop against the SSRF blocklist - Wire SSRF validation and EOF sanitization into media/download-image - Validate webhook URLs and OIDC profile picture URLs against SSRF - Restrict /assets/by-id to require authentication for non-public buckets (profile) while keeping public access for file-media-object, file-object-thumbnail, team-font-variant, and file-data-fragment - Add config knobs: ssrf-protection-enabled, ssrf-allowed-hosts, ssrf-extra-blocked-cidrs Signed-off-by: Andrey Antukh <niwi@niwi.nz> --------- Signed-off-by: Andrey Antukh <niwi@niwi.nz>	2026-05-08 09:18:22 +02:00
Andrey Antukh	cbd5f7795b	✨ Add minor compatibility adjustments for audit archive task (#8491)	2026-04-27 16:15:35 +02:00
Andrey Antukh	52dd9271a9	🐛 Encode header values as strings on audit archive task	2025-11-27 16:09:15 +01:00
Andrey Antukh	61d9b57bc7	♻️ Refactor internal tokens API ... Mainly make it receive the whol cfg/system instead only props. This makes the api more flexible for a future extending without the need to change the api again.	2025-10-07 12:08:00 +02:00
Andrey Antukh	283eb0419c	♻️ Refactor time related namespaces ... Mainly removes the custom app.util.time namespace from frontend and backend and normalize all to use the app.common.time namespace	2025-08-01 11:20:01 +02:00
Andrey Antukh	88fb5e7ab5	♻️ Update integrant to latest version ... This upgrade also includes complete elimination of use spec from the backend codebase, completing the long running migration to fully use malli for validation and decoding.	2024-11-13 19:09:19 +01:00
Andrey Antukh	fd24831c71	✨ Move audit tasks to separated namespace files	2024-03-25 10:46:15 +01:00