Erik Michelson
0dda149c7f
fix(permissions): ignore unknown permission values ...
The permission checks did not check for unknown permission values
submitted to the server. This allowed bypassing permission checks
under certain circumstances. However, this is not as critical as
it might sound at first, since checks guard that only the owner
can modify note permissions and the owner already has always
full permission to their note.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2026-07-24 21:39:28 +02:00
chore(config): remove unused allowOrigin config option
2026-07-22 22:54:36 +02:00
refactor: remove Temp
2026-07-22 22:54:36 +02:00
refactor: remove Temp
2026-07-22 22:54:36 +02:00
fix(ot): keep pendingOps in StaleWithBuffer during applyClient
2026-03-24 21:12:41 +01:00
refactor: remove Temp
2026-07-22 22:54:36 +02:00
Adapt code for eslint-config-standard 17
2022-05-01 21:19:44 +02:00
refactor(embeds): drop slideshare, use vimeo api, tighten CSP
2025-04-10 00:21:55 +02:00
feat: rate-limiting
2025-02-01 21:12:08 +01:00
refactor: use user-token for historyDelete too
2025-11-26 19:28:53 +01:00
fix(editor): always use random hex colors
2026-02-18 19:43:33 +01:00
feat(editor): add external link warning page
2026-06-10 20:15:09 +02:00
Fix eslint warnings
2019-05-31 00:30:29 +02:00
Add custom prometheus metrics
2021-04-25 20:06:56 +02:00
fix(permissions): ignore unknown permission values
2026-07-24 21:39:28 +02:00
fix(gist-export): validate OAuth2 state and redirect URI
2026-06-18 23:56:45 +02:00
Ensure case-sensitive DB queries on MySQL/MariaDB
2024-09-01 13:54:18 +02:00
0dda149c7f