Maintenance: Addressed all phpstan level 5 issues

Currently causing extra files to be created alongside previous files in
crowdin

.env.example.complete

@@ -395,6 +395,19 @@ ALLOWED_IFRAME_HOSTS=null
 # Current host and source for the "DRAWIO" setting will be auto-appended to the sources configured.
 ALLOWED_IFRAME_SOURCES="https://*.draw.io https://*.youtube.com https://*.youtube-nocookie.com https://*.vimeo.com"
 
+# A list of sources/hostnames that can be loaded as CSS styles within BookStack.
+# Space separated if multiple. BookStack host domain is auto-inferred.
+# Defaults to a permissive set if not provided.
+# Example: ALLOWED_STYLE_SOURCES="https://fonts.googleapis.com"
+ALLOWED_STYLE_SOURCES=null
+
+# A list of sources/hostnames that can be loaded as image content within BookStack.
+# Space separated if multiple. BookStack host domain is auto-inferred, in addition to
+# data and blob images, due to their use for various functionality.
+# Defaults to a permissive set if not provided.
+# Example: ALLOWED_IMAGE_SOURCES="https://images.example.com"
+ALLOWED_IMAGE_SOURCES=null
+
 # A list of the sources/hostnames that can be reached by application SSR calls.
 # This is used wherever users can provide URLs/hosts in-platform, like for webhooks.
 # Host-specific functionality (usually controlled via other options) like auth

.forgejo/CODE_OF_CONDUCT.md

@@ -0,0 +1,2 @@
+Please find our community rules on our website here:
+https://www.bookstackapp.com/about/community-rules/

.forgejo/FUNDING.yml

@@ -0,0 +1,4 @@
+# These are supported funding model platforms
+
+github: [ssddanbrown]
+ko_fi: ssddanbrown

.forgejo/ISSUE_TEMPLATE/api_request.yml

@@ -1,6 +1,6 @@
 name: New API Endpoint or API Ability
 description: Request a new endpoint or API feature be added
-labels: [":nut_and_bolt: API Request"]
+labels: ["Type/API Request"]
 body:
   - type: textarea
     id: feature

.forgejo/ISSUE_TEMPLATE/bug_report.yml

@@ -1,6 +1,6 @@
 name: Bug Report
 description: Create a report to help us fix bugs & issues in existing supported functionality
-labels: [":bug: Bug"]
+labels: ["Type/Bug Report"]
 body:
   - type: markdown
     attributes:

.forgejo/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,13 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Community Forum Support
+    url: https://community.bookstackapp.com
+    about: Get support by talking with the BookStack team & community.
+
+  - name: Debugging & Common Issues
+    url: https://www.bookstackapp.com/docs/admin/debugging/
+    about: Find details on how to debug issues and view common issues with their resolutions.
+
+  - name: Official Support Plans
+    url: https://www.bookstackapp.com/support/
+    about: View our official support plans that offer assured support for business.

.forgejo/ISSUE_TEMPLATE/feature_request.yml

@@ -1,6 +1,6 @@
 name: Feature Request
 description: Request a new feature or idea to be added to BookStack
-labels: [":hammer: Feature Request"]
+labels: ["Type/Feature Request"]
 body:
   - type: textarea
     id: description
@@ -33,7 +33,7 @@ body:
     attributes:
       label: Have you searched for an existing open/closed issue?
       description: |
-        To help us keep these issues under control, please ensure you have first [searched our issue list](https://github.com/BookStackApp/BookStack/issues?q=is%3Aissue) for any existing issues that cover the fundamental benefit/goal of your request.
+        To help us keep these issues under control, please ensure you have first [searched our issue list](https://codeberg.org/bookstack/bookstack/issues) for any existing issues that cover the fundamental benefit/goal of your request.
       options:
         - label: I have searched for existing issues and none cover my fundamental request
           required: true

.forgejo/ISSUE_TEMPLATE/language_request.yml

@@ -1,6 +1,6 @@
 name: Language Request
 description: Request a new language to be added to Crowdin for you to translate
-labels: [":earth_africa: Translations"]
+labels: ["Focus: Translations"]
 assignees:
   - ssddanbrown
 body:

.forgejo/ISSUE_TEMPLATE/support_request.yml

@@ -1,6 +1,6 @@
 name: Support Request
 description: Request support for a specific problem you have not been able to solve yourself
-labels: [":dog2: Support"]
+labels: ["Type/Support"]
 body:
   - type: checkboxes
     id: useddocs
@@ -15,11 +15,11 @@ body:
   - type: checkboxes
     id: searchissue
     attributes:
-      label: Searched GitHub Issues
+      label: Searched Existing Issues
       description: |
-        I have searched for the issue and potential resolutions within the [project's GitHub issue list](https://github.com/BookStackApp/BookStack/issues)
+        I have searched for the issue and potential resolutions within the [project's issue list](https://codeberg.org/bookstack/bookstack/issues)
       options:
-        - label: I have searched GitHub for the issue.
+        - label: I have searched for the issue.
           required: true
   - type: textarea
     id: scenario

.forgejo/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported Versions
 
-Only the [latest version](https://github.com/BookStackApp/BookStack/releases) of BookStack is supported.
+Only the [latest version](https://codeberg.org/bookstack/bookstack/releases) of BookStack is supported.
 We generally don't support older versions of BookStack due to maintenance effort and
 since we aim to provide a fairly stable upgrade path for new versions.
 
@@ -12,16 +12,14 @@ If you'd like to be notified of new potential security concerns you can [sign-up
 
 ## Reporting a Vulnerability
 
-If you've found an issue that likely has no impact to existing users (For example, in a development-only branch)
+If you've found an issue that likely has no impact to existing users (For example, an issue only in the development branch)
-feel free to raise it via a standard GitHub bug report issue.
+feel free to raise it via a standard Codeberg bug report issue.
 
 If the issue could have a security impact to BookStack instances, 
-please directly contact the lead maintainer [@ssddanbrown](https://github.com/ssddanbrown). 
+please directly contact the lead maintainer via email Dan Brown using the [details found here](https://www.bookstackapp.com/links/contact/).
-You will need to log in to be able to see the email address on the [GitHub profile page](https://github.com/ssddanbrown).
-Alternatively you can send a DM via Mastodon to [@danb@fosstodon.org](https://fosstodon.org/@danb).
 
 Please be patient while the vulnerability is being reviewed. Deploying the fix to address the vulnerability
 can often take a little time due to the amount of preparation required, to ensure the vulnerability has
 been covered, and to create the content required to adequately notify the user-base.
 
-Thank you for keeping BookStack instances safe!
+Thank you for keeping BookStack instances safe!

.forgejo/pull_request_template.md

@@ -0,0 +1,11 @@
+## Details
+
+<!-- Write details of your pull request in here -->
+<!-- Include references to any relevant issues/discussions -->
+
+## Checklist
+
+<!-- Put an 'x' in between the brackets below to confirm these elements -->
+
+- [ ] I have read the [BookStack community rules](https://www.bookstackapp.com/about/community-rules/).
+- [ ] This PR does not feature significant use of LLM/AI generation as per the community rules above.

.forgejo/workflows/analyse-php.yml

@@ -1,6 +1,7 @@
 name: analyse-php
 
 on:
+  workflow_dispatch:
   push:
     paths:
       - '**.php'
@@ -11,14 +12,16 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-24.04
+    runs-on: docker
+    container:
+      image: docker.io/library/node:24-trixie
     steps:
-    - uses: actions/checkout@v4
+    - uses: https://code.forgejo.org/actions/checkout@v6
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: https://github.com/shivammathur/setup-php@v2
       with:
-        php-version: 8.3
+        php-version: 8.5
         extensions: gd, mbstring, json, curl, xml, mysql, ldap
 
     - name: Get Composer Cache Directory
@@ -27,14 +30,16 @@ jobs:
         echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
     - name: Cache composer packages
-      uses: actions/cache@v4
+      uses: https://code.forgejo.org/actions/cache@v5
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
-        key: ${{ runner.os }}-composer-8.3
+        key: ${{ runner.os }}-composer-8.5
         restore-keys: ${{ runner.os }}-composer-
 
     - name: Install composer dependencies
       run: composer install --prefer-dist --no-interaction --ansi
+      env:
+        COMPOSER_AUTH: '{"github-oauth": {"github.com": "${{ secrets.GH_TOKEN }}"}}'
 
     - name: Run static analysis check
       run: composer check-static

.forgejo/workflows/lint-js.yml

@@ -1,6 +1,7 @@
 name: lint-js
 
 on:
+  workflow_dispatch:
   push:
     paths:
       - '**.js'
@@ -13,9 +14,11 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-24.04
+    runs-on: docker
+    container:
+      image: docker.io/library/node:24-trixie
     steps:
-    - uses: actions/checkout@v4
+    - uses: https://code.forgejo.org/actions/checkout@v6
 
     - name: Install NPM deps
       run: npm ci

.forgejo/workflows/lint-php.yml

@@ -1,6 +1,7 @@
 name: lint-php
 
 on:
+  workflow_dispatch:
   push:
     paths:
       - '**.php'
@@ -11,14 +12,16 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-24.04
+    runs-on: docker
+    container:
+      image: docker.io/library/node:24-trixie
     steps:
-    - uses: actions/checkout@v4
+    - uses: https://code.forgejo.org/actions/checkout@v6
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: https://github.com/shivammathur/setup-php@v2
       with:
-        php-version: 8.3
+        php-version: 8.5
         tools: phpcs
 
     - name: Run formatting check

.forgejo/workflows/sync-translations.yml

@@ -0,0 +1,34 @@
+name: Crowdin Action
+
+on:
+  push:
+    branches: [ development ]
+    paths:
+      - 'lang/**.php'
+  schedule:
+    - cron: '30 4 * * *'
+  workflow_dispatch:
+
+jobs:
+  synchronize-with-crowdin:
+    runs-on: docker
+    container:
+      image: docker.io/library/node:24-trixie
+
+    steps:
+      - name: Checkout
+        uses: https://code.forgejo.org/actions/checkout@v6
+
+      - name: crowdin action
+        uses: https://github.com/crowdin/github-action@v2
+        with:
+          crowdin_branch_name: development
+          upload_sources: true
+          upload_translations: false
+          download_translations: true
+          localization_branch_name: l10n_development
+          create_pull_request: false
+          github_base_url: codeberg.org
+        env:
+          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}

.forgejo/workflows/test-js.yml

@@ -1,6 +1,7 @@
 name: test-js
 
 on:
+  workflow_dispatch:
   push:
     paths:
       - '**.js'
@@ -15,9 +16,11 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-24.04
+    runs-on: docker
+    container:
+      image: docker.io/library/node:24-trixie
     steps:
-    - uses: actions/checkout@v6
+    - uses: https://code.forgejo.org/actions/checkout@v6
 
     - name: Install NPM deps
       run: npm ci
@@ -26,4 +29,4 @@ jobs:
       run: npm run ts:lint
 
     - name: Run JavaScript tests
-      run: npm run test
+      run: npm run test:ci

.forgejo/workflows/test-migrations.yml

@@ -1,6 +1,7 @@
 name: test-migrations
 
 on:
+  workflow_dispatch:
   push:
     paths:
       - '**.php'
@@ -13,15 +14,25 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-24.04
+    runs-on: docker
+    container:
+      image: docker.io/library/node:24-trixie
     strategy:
       matrix:
         php: ['8.2', '8.3', '8.4', '8.5']
+    services:
+      mysql:
+        image: docker.io/library/mariadb:12.2.2-noble
+        env:
+          MARIADB_USER: bookstack-test
+          MARIADB_PASSWORD: bookstack-test
+          MARIADB_DATABASE: bookstack-test
+          MARIADB_ROOT_PASSWORD: password
     steps:
-      - uses: actions/checkout@v4
+      - uses: https://code.forgejo.org/actions/checkout@v6
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: https://github.com/shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php }}
           extensions: gd, mbstring, json, curl, xml, mysql, ldap
@@ -32,34 +43,31 @@ jobs:
           echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer packages
-        uses: actions/cache@v4
+        uses: https://code.forgejo.org/actions/cache@v5
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ matrix.php }}
           restore-keys: ${{ runner.os }}-composer-
 
-      - name: Start MySQL
-        run: |
-          sudo systemctl start mysql
-
-      - name: Create database & user
-        run: |
-          mysql -uroot -proot -e 'CREATE DATABASE IF NOT EXISTS `bookstack-test`;'
-          mysql -uroot -proot -e "CREATE USER 'bookstack-test'@'localhost' IDENTIFIED WITH mysql_native_password BY 'bookstack-test';"
-          mysql -uroot -proot -e "GRANT ALL ON \`bookstack-test\`.* TO 'bookstack-test'@'localhost';"
-          mysql -uroot -proot -e 'FLUSH PRIVILEGES;'
-
       - name: Install composer dependencies
         run: composer install --prefer-dist --no-interaction --ansi
+        env:
+          COMPOSER_AUTH: '{"github-oauth": {"github.com": "${{ secrets.GH_TOKEN }}"}}'
 
       - name: Start migration test
+        env:
+          TEST_DATABASE_URL: 'mysql://bookstack-test:bookstack-test@mysql/bookstack-test'
         run: |
           php${{ matrix.php }} artisan migrate --force -n --database=mysql_testing
 
       - name: Start migration:rollback test
+        env:
+          TEST_DATABASE_URL: 'mysql://bookstack-test:bookstack-test@mysql/bookstack-test'
         run: |
           php${{ matrix.php }} artisan migrate:rollback --force -n --database=mysql_testing
 
       - name: Start migration rerun test
+        env:
+          TEST_DATABASE_URL: 'mysql://bookstack-test:bookstack-test@mysql/bookstack-test'
         run: |
           php${{ matrix.php }} artisan migrate --force -n --database=mysql_testing

.forgejo/workflows/test-php.yml

@@ -1,6 +1,7 @@
 name: test-php
 
 on:
+  workflow_dispatch:
   push:
     paths:
       - '**.php'
@@ -13,18 +14,38 @@ on:
 jobs:
   build:
     if: ${{ github.ref != 'refs/heads/l10n_development' }}
-    runs-on: ubuntu-24.04
+    runs-on: docker
+    container:
+      image: docker.io/setupphp/node:noble
     strategy:
       matrix:
         php: ['8.2', '8.3', '8.4', '8.5']
+    env:
+      phpextensions: gd, mbstring, json, curl, xml, mysql, ldap, gmp
+      phpextensioncachekey: cache-v1
     steps:
-    - uses: actions/checkout@v4
+    - uses: https://code.forgejo.org/actions/checkout@v6
 
-    - name: Setup PHP
+    - name: Setup cache environment
-      uses: shivammathur/setup-php@v2
+      id: extcache
+      uses: https://github.com/shivammathur/cache-extensions@v1
       with:
         php-version: ${{ matrix.php }}
-        extensions: gd, mbstring, json, curl, xml, mysql, ldap, gmp
+        extensions: ${{ env.phpextensions }}
+        key: ${{ env.phpextensioncachekey }}
+
+    - name: Cache extensions
+      uses: https://code.forgejo.org/actions/cache@v5
+      with:
+        path: ${{ steps.extcache.outputs.dir }}
+        key: ${{ steps.extcache.outputs.key }}
+        restore-keys: ${{ steps.extcache.outputs.key }}
+
+    - name: Setup PHP
+      uses: https://github.com/shivammathur/setup-php@v2
+      with:
+        php-version: ${{ matrix.php }}
+        extensions: ${{ env.phpextensions }}
 
     - name: Get Composer Cache Directory
       id: composer-cache
@@ -32,30 +53,36 @@ jobs:
         echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
     - name: Cache composer packages
-      uses: actions/cache@v4
+      uses: https://code.forgejo.org/actions/cache@v5
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
         key: ${{ runner.os }}-composer-${{ matrix.php }}
         restore-keys: ${{ runner.os }}-composer-
 
-    - name: Start Database
+    - name: Install composer dependencies
+      run: composer install --prefer-dist --no-interaction --ansi
+      env:
+        COMPOSER_AUTH: '{"github-oauth": {"github.com": "${{ secrets.GH_TOKEN }}"}}'
+
+    - name: Start MySQL
       run: |
         sudo systemctl start mysql
 
-    - name: Setup Database
+    - name: Create database & user
       run: |
         mysql -uroot -proot -e 'CREATE DATABASE IF NOT EXISTS `bookstack-test`;'
         mysql -uroot -proot -e "CREATE USER 'bookstack-test'@'localhost' IDENTIFIED WITH mysql_native_password BY 'bookstack-test';"
         mysql -uroot -proot -e "GRANT ALL ON \`bookstack-test\`.* TO 'bookstack-test'@'localhost';"
         mysql -uroot -proot -e 'FLUSH PRIVILEGES;'
 
-    - name: Install composer dependencies
-      run: composer install --prefer-dist --no-interaction --ansi
-
     - name: Migrate and seed the database
+      env:
+        TEST_DATABASE_URL: 'mysql://bookstack-test:bookstack-test@localhost/bookstack-test'
       run: |
         php${{ matrix.php }} artisan migrate --force -n --database=mysql_testing
         php${{ matrix.php }} artisan db:seed --force -n --class=DummyContentSeeder --database=mysql_testing
 
     - name: Run PHP tests
+      env:
+        TEST_DATABASE_URL: 'mysql://bookstack-test:bookstack-test@localhost/bookstack-test'
       run: php${{ matrix.php }} ./vendor/bin/phpunit

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,8 @@
 blank_issues_enabled: false
 contact_links:
-  - name: Discord Chat Support
+  - name: Open Issues Here Instead
-    url: https://discord.gg/ztkBqR2
+    url: https://codeberg.org/bookstack/bookstack/issues
-    about: Realtime support & chat with the BookStack community and the team.
+    about: This project has migrated to Codeberg, please open issues there instead.
 
   - name: Debugging & Common Issues
     url: https://www.bookstackapp.com/docs/admin/debugging/

.github/pull_request_template.md

@@ -1,11 +1,10 @@
-## Details
+**Warning:**
 
-<!-- Write details of your pull request in here -->
+This project has migrated to Codeberg:
-<!-- Include references to any relevant issues/discussions -->
+https://codeberg.org/bookstack/bookstack
 
-## Checklist
+Please open pull requests here instead.
 
-<!-- Put an 'x' in between the brackets below to confirm these elements -->
+ANY PULL REQUESTS OPENED HERE WILL BE CLOSED WITHOUT COMMENT OR MERGE.
 
-- [ ] I have read the [BookStack community rules](https://www.bookstackapp.com/about/community-rules/).
+---
-- [ ] This PR does not feature significant use of LLM/AI generation as per the community rules above.

.github/translators.txt

@@ -533,7 +533,14 @@ JanDziaslo :: Polish
 Charllys Fernandes (CharllysFernandes) :: Portuguese, Brazilian
 Ilgiz Zigangirov (inov8) :: Russian
 Max Israelsson (Blezie) :: Swedish
-Skiddybison5924 (chris-devel0per) :: German
+Skiddybison5924 (chris-devel0per) :: German Informal; German
 Veyilla Nightwhisper (Veyilla) :: German
 João Barbosa (hypeedd) :: Portuguese
 Abcdefg Hijklmn (collatek) :: Korean
+Suthep Yonphimai (tomztt) :: Thai
+MrClock (MrClock8163) :: Hungarian
+Elena0875 :: Russian
+FelixFrizzy :: German
+Pedro de Mattia (pdmtt) :: Portuguese, Brazilian
+lonestan :: Russian
+Paul Kernstock (kernstock) :: German

app/Access/Controllers/HandlesPartialLogins.php

@@ -22,4 +22,10 @@ trait HandlesPartialLogins
 
         return $user;
     }
+
+    protected function clearLastAttemptedUser(): void
+    {
+        $loginService = app()->make(LoginService::class);
+        $loginService->clearLastLoginAttempted();
+    }
 }

app/Access/Controllers/MfaBackupCodesController.php

@@ -6,6 +6,7 @@ use BookStack\Access\LoginService;
 use BookStack\Access\Mfa\BackupCodeService;
 use BookStack\Access\Mfa\MfaSession;
 use BookStack\Access\Mfa\MfaValue;
+use BookStack\Access\Mfa\MfaVerificationLimiter;
 use BookStack\Activity\ActivityType;
 use BookStack\Exceptions\NotFoundException;
 use BookStack\Http\Controller;
@@ -19,6 +20,11 @@ class MfaBackupCodesController extends Controller
 
     protected const SETUP_SECRET_SESSION_KEY = 'mfa-setup-backup-codes';
 
+    public function __construct(
+        protected MfaVerificationLimiter $limiter,
+    ) {
+    }
+
     /**
      * Show a view that generates and displays backup codes.
      */
@@ -71,6 +77,12 @@ class MfaBackupCodesController extends Controller
     public function verify(Request $request, BackupCodeService $codeService, MfaSession $mfaSession, LoginService $loginService)
     {
         $user = $this->currentOrLastAttemptedUser();
+        $this->limiter->incrementAttempts($user, $request);
+        if ($this->limiter->hasHitLimit($user, $request)) {
+            $this->clearLastAttemptedUser();
+            $this->limiter->throwException();
+        }
+
         $codes = MfaValue::getValueForUser($user, MfaValue::METHOD_BACKUP_CODES) ?? '[]';
 
         $this->validate($request, [
@@ -89,6 +101,7 @@ class MfaBackupCodesController extends Controller
 
         $mfaSession->markVerifiedForUser($user);
         $loginService->reattemptLoginFor($user);
+        $this->limiter->decrementAttempts($user, $request);
 
         if ($codeService->countCodesInSet($updatedCodes) < 5) {
             $this->showWarningNotification(trans('auth.mfa_backup_codes_usage_limit_warning'));

app/Access/Controllers/MfaTotpController.php

@@ -5,6 +5,7 @@ namespace BookStack\Access\Controllers;
 use BookStack\Access\LoginService;
 use BookStack\Access\Mfa\MfaSession;
 use BookStack\Access\Mfa\MfaValue;
+use BookStack\Access\Mfa\MfaVerificationLimiter;
 use BookStack\Access\Mfa\TotpService;
 use BookStack\Access\Mfa\TotpValidationRule;
 use BookStack\Activity\ActivityType;
@@ -20,7 +21,8 @@ class MfaTotpController extends Controller
     protected const SETUP_SECRET_SESSION_KEY = 'mfa-setup-totp-secret';
 
     public function __construct(
-        protected TotpService $totp
+        protected TotpService $totp,
+        protected MfaVerificationLimiter $limiter,
     ) {
     }
 
@@ -86,6 +88,12 @@ class MfaTotpController extends Controller
     public function verify(Request $request, LoginService $loginService, MfaSession $mfaSession)
     {
         $user = $this->currentOrLastAttemptedUser();
+        $this->limiter->incrementAttempts($user, $request);
+        if ($this->limiter->hasHitLimit($user, $request)) {
+            $this->clearLastAttemptedUser();
+            $this->limiter->throwException();
+        }
+
         $totpSecret = MfaValue::getValueForUser($user, MfaValue::METHOD_TOTP);
 
         $this->validate($request, [
@@ -98,6 +106,7 @@ class MfaTotpController extends Controller
 
         $mfaSession->markVerifiedForUser($user);
         $loginService->reattemptLoginFor($user);
+        $this->limiter->decrementAttempts($user, $request);
 
         return redirect()->intended();
     }

app/Access/ExternalBaseUserProvider.php

@@ -42,7 +42,7 @@ class ExternalBaseUserProvider implements UserProvider
     /**
      * Retrieve a user by the given credentials.
      */
-    public function retrieveByCredentials(array $credentials): ?Authenticatable
+    public function retrieveByCredentials(array $credentials): ?User
     {
         return User::query()
             ->where('external_auth_id', $credentials['external_auth_id'])

app/Access/Guards/ExternalBaseSessionGuard.php

@@ -50,8 +50,12 @@ class ExternalBaseSessionGuard implements StatefulGuard
     /**
      * Create a new authentication guard.
      */
-    public function __construct(string $name, UserProvider $provider, Session $session, RegistrationService $registrationService)
+    public function __construct(
-    {
+        string $name,
+        UserProvider $provider,
+        Session $session,
+        RegistrationService $registrationService
+    ) {
         $this->name = $name;
         $this->session = $session;
         $this->provider = $provider;

app/Access/Guards/LdapSessionGuard.php

@@ -83,6 +83,10 @@ class LdapSessionGuard extends ExternalBaseSessionGuard
             }
         }
 
+        if (!($user instanceof User)) {
+            throw new LoginAttemptException('Could not find or create a user for LDAP login.');
+        }
+
         // Sync LDAP groups if required
         if ($this->ldapService->shouldSyncGroups()) {
             $this->ldapService->syncGroups($user, $username);

app/Access/LoginService.php

@@ -126,7 +126,7 @@ class LoginService
     /**
      * Clear the last login attempted session value.
      */
-    protected function clearLastLoginAttempted(): void
+    public function clearLastLoginAttempted(): void
     {
         session()->remove(self::LAST_LOGIN_ATTEMPTED_SESSION_KEY);
     }

app/Access/Mfa/MfaVerificationLimiter.php

@@ -0,0 +1,62 @@
+<?php
+
+namespace BookStack\Access\Mfa;
+
+use BookStack\Exceptions\NotifyException;
+use BookStack\Users\Models\User;
+use Illuminate\Cache\RateLimiter;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+
+/**
+ * A rate limit specifically for MFA verification.
+ * Limits across both the attempted user (on a tight limit) and the
+ * request IP (on a less strict limit).
+ */
+class MfaVerificationLimiter
+{
+    protected int $maxUserAttemptsPerMinute = 5;
+    protected int $maxIpAttemptsPerMinute = 60;
+
+    public function __construct(
+        protected RateLimiter $rateLimiter
+    ) {
+    }
+
+    public function throwException(): never
+    {
+        throw new NotifyException(
+            trans('auth.mfa_throttle', ['seconds' => 60]),
+            '/login',
+            Response::HTTP_TOO_MANY_REQUESTS
+        );
+    }
+
+    public function incrementAttempts(User $user, Request $request): void
+    {
+        $this->rateLimiter->hit($this->getUserKey($user));
+        $this->rateLimiter->hit($this->getRequestKey($request));
+    }
+
+    public function decrementAttempts(User $user, Request $request): void
+    {
+        $this->rateLimiter->decrement($this->getUserKey($user));
+        $this->rateLimiter->decrement($this->getRequestKey($request));
+    }
+
+    public function hasHitLimit(User $user, Request $request): bool
+    {
+        return $this->rateLimiter->tooManyAttempts($this->getUserKey($user), $this->maxUserAttemptsPerMinute + 1)
+            || $this->rateLimiter->tooManyAttempts($this->getRequestKey($request), $this->maxIpAttemptsPerMinute + 1);
+    }
+
+    protected function getUserKey(User $user): string
+    {
+        return "mfa-attempt::user::{$user->id}";
+    }
+
+    protected function getRequestKey(Request $request): string
+    {
+        return "mfa-attempt::request::{$request->ip()}";
+    }
+}

app/Access/Oidc/OidcJwtWithClaims.php

@@ -131,8 +131,6 @@ class OidcJwtWithClaims implements ProvidesClaims
             }
         }, $this->keys);
 
-        $parsedKeys = array_filter($parsedKeys);
-
         $contentToSign = $this->tokenParts[0] . '.' . $this->tokenParts[1];
         /** @var OidcJwtSigningKey $parsedKey */
         foreach ($parsedKeys as $parsedKey) {

app/Access/Oidc/OidcService.php

@@ -80,6 +80,7 @@ class OidcService
         $provider->setPkceCode($pkceCode);
 
         // Try to exchange authorization code for access token
+        /** @var OidcAccessToken $accessToken */
         $accessToken = $provider->getAccessToken('authorization_code', [
             'code' => $authorizationCode,
         ]);

app/Activity/ActivityQueries.php

@@ -11,6 +11,7 @@ use BookStack\Entities\Tools\MixedEntityListLoader;
 use BookStack\Permissions\PermissionApplicator;
 use BookStack\Users\Models\User;
 use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 use Illuminate\Database\Eloquent\Relations\Relation;
 
@@ -27,6 +28,7 @@ class ActivityQueries
      */
     public function latest(int $count = 20, int $page = 0): array
     {
+        /** @var Collection<int, Activity> $activityList */
         $activityList = $this->permissions
             ->restrictEntityRelationQuery(Activity::query(), 'activities', 'loggable_id', 'loggable_type')
             ->orderBy('created_at', 'desc')
@@ -83,6 +85,7 @@ class ActivityQueries
      */
     public function userActivity(User $user, int $count = 20, int $page = 0): array
     {
+        /** @var Collection<int, Activity> $activityList */
         $activityList = $this->permissions
             ->restrictEntityRelationQuery(Activity::query(), 'activities', 'loggable_id', 'loggable_type')
             ->orderBy('created_at', 'desc')

app/Activity/ActivityType.php

@@ -46,6 +46,7 @@ class ActivityType
     const USER_CREATE = 'user_create';
     const USER_UPDATE = 'user_update';
     const USER_DELETE = 'user_delete';
+    const USER_MFA_RESET = 'user_mfa_reset';
 
     const API_TOKEN_CREATE = 'api_token_create';
     const API_TOKEN_UPDATE = 'api_token_update';

app/Activity/Models/Comment.php

@@ -3,6 +3,7 @@
 namespace BookStack\Activity\Models;
 
 use BookStack\App\Model;
+use BookStack\Entities\Models\Page;
 use BookStack\Permissions\Models\JointPermission;
 use BookStack\Permissions\PermissionApplicator;
 use BookStack\Users\Models\HasCreatorAndUpdater;
@@ -40,6 +41,9 @@ class Comment extends Model implements Loggable, OwnableInterface
 
     /**
      * Get the entity that this comment belongs to.
+     * It's only pages right now hence the typing below.
+     * Would need a deeper audit if that changes as many areas assume this is always a page.
+     * @return MorphTo<Page, $this>
      */
     public function entity(): MorphTo
     {
@@ -55,7 +59,9 @@ class Comment extends Model implements Loggable, OwnableInterface
 
         // Ultimately, we could just align the method name to 'commentable' but that would be a potential
         // breaking change and not really worthwhile in a patch due to the risk of creating extra problems.
-        return $this->morphTo(null, 'commentable_type', 'commentable_id');
+        /** @var MorphTo<Page, $this> $relation */
+        $relation = $this->morphTo(null, 'commentable_type', 'commentable_id');
+        return $relation;
     }
 
     /**

app/Activity/Tools/WebhookFormatter.php

@@ -73,13 +73,17 @@ class WebhookFormatter
         // Load entity owner, creator, updater details
         $this->addModelFormatter(
             fn ($event, $model) => ($model instanceof Entity),
-            fn ($model) => $model->load(['ownedBy', 'createdBy', 'updatedBy'])
+            function ($model) {
+                $model->load(['ownedBy', 'createdBy', 'updatedBy']);
+            }
         );
 
         // Load revision detail for page update and create events
         $this->addModelFormatter(
             fn ($event, $model) => ($model instanceof Page && ($event === ActivityType::PAGE_CREATE || $event === ActivityType::PAGE_UPDATE)),
-            fn ($model) => $model->load('currentRevision')
+            function ($model) {
+                $model->load('currentRevision');
+            }
         );
     }
 

app/Api/ApiDocsGenerator.php

@@ -138,8 +138,8 @@ class ApiDocsGenerator
             return $validation;
         }
 
-        if (is_object($validation) && method_exists($validation, '__toString')) {
+        if (is_object($validation) && $validation instanceof \Stringable) {
-            return strval($validation);
+            return $validation->__toString();
         }
 
         if ($validation instanceof Password) {

app/App/Providers/ThemeServiceProvider.php

@@ -7,6 +7,7 @@ use BookStack\Theming\ThemeService;
 use BookStack\Theming\ThemeViews;
 use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\ServiceProvider;
+use Illuminate\View\FileViewFinder;
 
 class ThemeServiceProvider extends ServiceProvider
 {
@@ -27,7 +28,11 @@ class ThemeServiceProvider extends ServiceProvider
         // Boot up the theme system
         $themeService = $this->app->make(ThemeService::class);
         $viewFactory = $this->app->make('view');
-        $themeViews = new ThemeViews($viewFactory->getFinder());
+        $viewFinder = $viewFactory->getFinder();
+        if (!($viewFinder instanceof FileViewFinder)) {
+            throw new \Exception('Only the file view finder is supported for the theme system');
+        }
+        $themeViews = new ThemeViews($viewFinder);
 
         // Use a custom include so that we can insert theme views before/after includes.
         // This is done, even if no theme is active, so that view caching does not create problems

app/App/PwaManifestBuilder.php

@@ -10,7 +10,7 @@ class PwaManifestBuilder
         // does not start a session, so we won't have current user context.
         // This was attempted but removed since manifest calls could affect user session
         // history tracking and back redirection.
-        // Context: https://github.com/BookStackApp/BookStack/issues/4649
+        // Context: https://codeberg.org/bookstack/bookstack/issues/4649
         $darkMode = (bool) setting()->getForCurrentUser('dark-mode-enabled');
         $appName = setting('app-name');
 

app/App/helpers.php

@@ -6,6 +6,7 @@ use BookStack\Facades\Theme;
 use BookStack\Permissions\Permission;
 use BookStack\Permissions\PermissionApplicator;
 use BookStack\Settings\SettingService;
+use BookStack\Users\Models\OwnableInterface;
 use BookStack\Users\Models\User;
 
 /**
@@ -40,7 +41,7 @@ function user(): User
  * Check if the current user has a permission. If an ownable element
  * is passed in the jointPermissions are checked against that particular item.
  */
-function userCan(string|Permission $permission, ?Model $ownable = null): bool
+function userCan(string|Permission $permission, (Model&OwnableInterface)|null $ownable = null): bool
 {
     if (is_null($ownable)) {
         return user()->can($permission);

app/Config/app.php

@@ -72,6 +72,17 @@ return [
     // Current host and source for the "DRAWIO" setting will be auto-appended to the sources configured.
     'iframe_sources' => env('ALLOWED_IFRAME_SOURCES', 'https://*.draw.io https://*.youtube.com https://*.youtube-nocookie.com https://*.vimeo.com'),
 
+    // A list of style sources/hostnames that can be loaded styles within BookStack.
+    // Space separated if multiple. BookStack host domain is auto-inferred.
+    // If not set, a permissive default set is used to reduce potential breakage.
+    'style_sources' => env('ALLOWED_STYLE_SOURCES', null),
+
+    // A list of sources/hostnames that can be loaded as image content within BookStack.
+    // Space separated if multiple. BookStack host domain is auto-inferred, in addition to
+    // data and blob images, due to their use for various functionality.
+    // If not set, a permissive default set is used to reduce potential breakage.
+    'image_sources' => env('ALLOWED_IMAGE_SOURCES', null),
+
     // A list of the sources/hostnames that can be reached by application SSR calls.
     // This is used wherever users can provide URLs/hosts in-platform, like for webhooks.
     // Host-specific functionality (usually controlled via other options) like auth

app/Config/database.php

@@ -81,7 +81,6 @@ return [
             'strict'         => false,
             'engine'         => null,
             'options'        => extension_loaded('pdo_mysql') ? array_filter([
-                // @phpstan-ignore class.notFound
                 (PHP_VERSION_ID >= 80500 ? \Pdo\Mysql::ATTR_SSL_CA : \PDO::MYSQL_ATTR_SSL_CA) => env('MYSQL_ATTR_SSL_CA'),
             ]) : [],
         ],

app/Config/exports.php

@@ -68,7 +68,7 @@ return [
          * Times-Roman, Times-Bold, Times-BoldItalic, Times-Italic,
          * Symbol, ZapfDingbats.
          */
-        'font_dir' => storage_path('fonts/'),  // advised by dompdf (https://github.com/dompdf/dompdf/pull/782)
+        'font_dir' => storage_path('fonts/dompdf'),  // advised by dompdf (https://github.com/dompdf/dompdf/pull/782)
 
         /**
          * The location of the DOMPDF font cache directory.
@@ -78,7 +78,7 @@ return [
          *
          * Note: This directory must exist and be writable by the webserver process.
          */
-        'font_cache' => storage_path('fonts/'),
+        'font_cache' => storage_path('fonts/dompdf/cache'),
 
         /**
          * The location of a temporary directory.

app/Entities/Controllers/PageApiController.php

@@ -1,5 +1,7 @@
 <?php
 
+declare(strict_types=1);
+
 namespace BookStack\Entities\Controllers;
 
 use BookStack\Activity\Tools\CommentTree;
@@ -10,7 +12,9 @@ use BookStack\Exceptions\PermissionsException;
 use BookStack\Http\ApiController;
 use BookStack\Permissions\Permission;
 use Exception;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class PageApiController extends ApiController
 {
@@ -45,7 +49,7 @@ class PageApiController extends ApiController
     /**
      * Get a listing of pages visible to the user.
      */
-    public function list()
+    public function list(): JsonResponse
     {
         $pages = $this->queries->visibleForList()
             ->addSelect(['created_by', 'updated_by', 'revision_count', 'editor']);
@@ -69,7 +73,7 @@ class PageApiController extends ApiController
      * Any images included via base64 data URIs will be extracted and saved as gallery
      * images against the page during upload.
      */
-    public function create(Request $request)
+    public function create(Request $request): JsonResponse
     {
         $this->validate($request, $this->rules['create']);
 
@@ -102,9 +106,9 @@ class PageApiController extends ApiController
      * Comments for the page are provided in a tree-structure representing the hierarchy of top-level
      * comments and replies, for both archived and active comments.
      */
-    public function read(string $id)
+    public function read(string $id): JsonResponse
     {
-        $page = $this->queries->findVisibleByIdOrFail($id);
+        $page = $this->queries->findVisibleByIdOrFail(intval($id));
 
         $page = $page->forJsonDisplay();
         $commentTree = (new CommentTree($page));
@@ -124,11 +128,11 @@ class PageApiController extends ApiController
      * Providing a 'book_id' or 'chapter_id' property will essentially move
      * the page into that parent element if you have permissions to do so.
      */
-    public function update(Request $request, string $id)
+    public function update(Request $request, string $id): JsonResponse
     {
         $requestData = $this->validate($request, $this->rules['update']);
 
-        $page = $this->queries->findVisibleByIdOrFail($id);
+        $page = $this->queries->findVisibleByIdOrFail(intval($id));
         $this->checkOwnablePermission(Permission::PageUpdate, $page);
 
         $parent = null;
@@ -161,9 +165,9 @@ class PageApiController extends ApiController
      * Delete a page.
      * This will typically send the page to the recycle bin.
      */
-    public function delete(string $id)
+    public function delete(string $id): Response
     {
-        $page = $this->queries->findVisibleByIdOrFail($id);
+        $page = $this->queries->findVisibleByIdOrFail(intval($id));
         $this->checkOwnablePermission(Permission::PageDelete, $page);
 
         $this->pageRepo->destroy($page);

app/Entities/Controllers/PageController.php

@@ -25,6 +25,7 @@ use BookStack\Util\HtmlContentFilter;
 use BookStack\Util\HtmlContentFilterConfig;
 use Exception;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Http\Request;
 use Illuminate\Validation\ValidationException;
 use Throwable;
@@ -358,8 +359,8 @@ class PageController extends Controller
      */
     public function showRecentlyUpdated()
     {
-        $visibleBelongsScope = function (BelongsTo $query) {
+        $visibleBelongsScope = function (Relation $relation): void {
-            $query->scopes('visible');
+            $relation->scopes('visible');
         };
 
         $pages = $this->queries->visibleForList()

app/Entities/Controllers/PageRevisionController.php

@@ -177,7 +177,7 @@ class PageRevisionController extends Controller
      */
     public function destroyUserDraft(string $pageId)
     {
-        $page = $this->pageQueries->findVisibleByIdOrFail($pageId);
+        $page = $this->pageQueries->findVisibleByIdOrFail(intval($pageId));
         $this->revisionRepo->deleteDraftsForCurrentUser($page);
 
         return response('', 200);

app/Entities/Models/Book.php

@@ -20,10 +20,10 @@ use Illuminate\Support\Collection;
  * @property ?int                                     $image_id
  * @property ?int                                     $default_template_id
  * @property ?int                                     $sort_rule_id
- * @property \Illuminate\Database\Eloquent\Collection $chapters
+ * @property \Illuminate\Database\Eloquent\Collection<int, Chapter> $chapters
- * @property \Illuminate\Database\Eloquent\Collection $pages
+ * @property \Illuminate\Database\Eloquent\Collection<int, Page> $pages
- * @property \Illuminate\Database\Eloquent\Collection $directPages
+ * @property \Illuminate\Database\Eloquent\Collection<int, Page> $directPages
- * @property \Illuminate\Database\Eloquent\Collection $shelves
+ * @property \Illuminate\Database\Eloquent\Collection<int, Bookshelf> $shelves
  * @property ?SortRule                                $sortRule
  */
 class Book extends Entity implements HasDescriptionInterface, HasCoverInterface, HasDefaultTemplateInterface

app/Entities/Models/Entity.php

@@ -46,7 +46,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
  * @property int|null   $created_by
  * @property int|null   $updated_by
  * @property int|null   $owned_by
- * @property Collection $tags
+ * @property Collection<int, Tag> $tags
  *
  * @method static Entity|Builder visible()
  * @method static Builder withLastView()

app/Entities/Models/Page.php

@@ -24,8 +24,8 @@ use Illuminate\Database\Eloquent\Relations\HasOne;
  * @property int          $revision_count
  * @property string       $editor
  * @property Chapter|null $chapter
- * @property Collection   $attachments
+ * @property Collection<int, Attachment>   $attachments
- * @property Collection   $revisions
+ * @property Collection<int, PageRevision>   $revisions
  * @property PageRevision $currentRevision
  */
 class Page extends BookChild

app/Entities/Queries/QueryPopular.php

@@ -6,6 +6,7 @@ use BookStack\Activity\Models\View;
 use BookStack\Entities\EntityProvider;
 use BookStack\Entities\Tools\MixedEntityListLoader;
 use BookStack\Permissions\PermissionApplicator;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
 
@@ -20,6 +21,7 @@ class QueryPopular
 
     public function run(int $count, int $page, array $filterModels): Collection
     {
+        /** @var Builder<View> $query */
         $query = $this->permissions
             ->restrictEntityRelationQuery(View::query(), 'views', 'viewable_id', 'viewable_type')
             ->select('*', 'viewable_id', 'viewable_type', DB::raw('SUM(views) as view_count'))

app/Entities/Queries/QueryRecentlyViewed.php

@@ -5,6 +5,7 @@ namespace BookStack\Entities\Queries;
 use BookStack\Activity\Models\View;
 use BookStack\Entities\Tools\MixedEntityListLoader;
 use BookStack\Permissions\PermissionApplicator;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Support\Collection;
 
 class QueryRecentlyViewed
@@ -22,6 +23,7 @@ class QueryRecentlyViewed
             return collect();
         }
 
+        /** @var Builder<View> $query */
         $query = $this->permissions->restrictEntityRelationQuery(
             View::query(),
             'views',

app/Entities/Queries/QueryTopFavourites.php

@@ -5,6 +5,7 @@ namespace BookStack\Entities\Queries;
 use BookStack\Activity\Models\Favourite;
 use BookStack\Entities\Tools\MixedEntityListLoader;
 use BookStack\Permissions\PermissionApplicator;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Query\JoinClause;
 
 class QueryTopFavourites
@@ -22,6 +23,7 @@ class QueryTopFavourites
             return collect();
         }
 
+        /** @var Builder<Favourite> $query */
         $query = $this->permissions
             ->restrictEntityRelationQuery(Favourite::query(), 'favourites', 'favouritable_id', 'favouritable_type')
             ->select('favourites.*')

app/Entities/Tools/Markdown/CustomListItemRenderer.php

@@ -25,9 +25,13 @@ class CustomListItemRenderer implements NodeRendererInterface
      */
     public function render(Node $node, ChildNodeRendererInterface $childRenderer)
     {
+        if (!($node instanceof ListItem)) {
+            return null;
+        }
+
         $listItem = $this->baseRenderer->render($node, $childRenderer);
 
-        if ($node instanceof ListItem && $this->startsTaskListItem($node) && $listItem instanceof HtmlElement) {
+        if ($this->startsTaskListItem($node) && $listItem instanceof HtmlElement) {
             $listItem->setAttribute('class', 'task-list-item');
         }
 

app/Entities/Tools/PageContent.php

@@ -421,28 +421,41 @@ class PageContent
      */
     protected function headerNodesToLevelList(DOMNodeList $nodeList): array
     {
-        $tree = collect($nodeList)->map(function (DOMElement $header) {
+        $minLevel = 6;
+
+        $headerDetails = array_map(function (DOMNode $header) use (&$minLevel) {
+            if (!$header instanceof DOMElement) {
+                return null;
+            }
+
             $text = trim(str_replace("\xc2\xa0", ' ', $header->nodeValue));
             $text = mb_substr($text, 0, 100);
 
+            if (empty($text)) {
+                return null;
+            }
+
+            $level = intval(str_replace('h', '', $header->nodeName));
+            if ($level < $minLevel) {
+                $minLevel = $level;
+            }
+
             return [
                 'nodeName' => strtolower($header->nodeName),
-                'level'    => intval(str_replace('h', '', $header->nodeName)),
+                'level'    => $level,
                 'link'     => '#' . $header->getAttribute('id'),
                 'text'     => $text,
             ];
-        })->filter(function ($header) {
+        }, [...$nodeList]);
-            return mb_strlen($header['text']) > 0;
+
-        });
+        $filtered = array_values(array_filter($headerDetails));
 
         // Shift headers if only smaller headers have been used
-        $levelChange = ($tree->pluck('level')->min() - 1);
+        $levelChange = ($minLevel - 1);
-        $tree = $tree->map(function ($header) use ($levelChange) {
+        foreach ($filtered as $index => $header) {
-            $header['level'] -= ($levelChange);
+            $filtered[$index]['level'] -= $levelChange;
+        }
 
-            return $header;
+        return $filtered;
-        });
-
-        return $tree->toArray();
     }
 }

app/Entities/Tools/PageIncludeParser.php

@@ -192,10 +192,10 @@ class PageIncludeParser
     /**
      * Get the parent paragraph of the given node, if existing.
      */
-    protected function getParentParagraph(DOMNode $parent): ?DOMNode
+    protected function getParentParagraph(DOMNode $parent): ?DOMElement
     {
         do {
-            if (strtolower($parent->nodeName) === 'p') {
+            if (strtolower($parent->nodeName) === 'p' && $parent instanceof DOMElement) {
                 return $parent;
             }
 

app/Entities/Tools/SlugGenerator.php

@@ -52,7 +52,7 @@ class SlugGenerator
     {
         $slug = Str::slug($name);
         if ($slug === '') {
-            $slug = substr(md5(rand(1, 500)), 0, 5);
+            $slug = substr(md5(strval(rand(1, 500))), 0, 5);
         }
 
         return $slug;

app/Exports/ImportRepo.php

@@ -3,6 +3,8 @@
 namespace BookStack\Exports;
 
 use BookStack\Activity\ActivityType;
+use BookStack\Entities\Models\Book;
+use BookStack\Entities\Models\Chapter;
 use BookStack\Entities\Models\Entity;
 use BookStack\Entities\Queries\EntityQueries;
 use BookStack\Exceptions\FileUploadException;
@@ -119,6 +121,9 @@ class ImportRepo
         $parentModel = null;
         if ($import->type === 'page' || $import->type === 'chapter') {
             $parentModel = $parent ? $this->entityQueries->findVisibleByStringIdentifier($parent) : null;
+            if ($parentModel && !($parentModel instanceof Book || $parentModel instanceof Chapter)) {
+                throw new ZipImportException(['Selected parent is not a book or chapter']);
+            }
         }
 
         DB::beginTransaction();

app/Exports/PdfGenerator.php

@@ -4,6 +4,8 @@ namespace BookStack\Exports;
 
 use BookStack\Exceptions\PdfExportException;
 use Dompdf\Dompdf;
+use FontLib\Font;
+use Illuminate\Support\Str;
 use Knp\Snappy\Pdf as SnappyPdf;
 use Symfony\Component\Process\Exception\ProcessTimedOutException;
 use Symfony\Component\Process\Process;
@@ -60,12 +62,65 @@ class PdfGenerator
         $domPdf = new Dompdf($options);
         $domPdf->setBasePath(base_path('public'));
 
+        $fontMetrics = $domPdf->getFontMetrics();
+        $userFontfamilies = $this->getUserDomPdfFontFamilies();
+        foreach ($userFontfamilies as $fontFamily => $fonts) {
+            try {
+                $fontMetrics->setFontFamily($fontFamily, $fonts);
+            } catch (\Exception $exception) {
+                $expectedPath = storage_path('fonts/dompdf');
+                throw new PdfExportException("Failed to create required font data in {$expectedPath}, Ensure all content in this location is writable by the web server");
+            }
+        }
+
         $domPdf->loadHTML($this->convertEntities($html));
         $domPdf->render();
 
         return (string) $domPdf->output();
     }
 
+    /**
+     * @return array<string, array<string, string>>
+     */
+    protected function getUserDomPdfFontFamilies(): array
+    {
+        $fontStore = storage_path('fonts/dompdf');
+        if (!is_dir($fontStore)) {
+            return [];
+        }
+
+        $fontFamilies = [];
+        $fontFiles = glob($fontStore . DIRECTORY_SEPARATOR . '*.ttf');
+        foreach ($fontFiles as $fontFile) {
+            $fontFileName = basename($fontFile, '.ttf');
+            $expectedUfm = $fontStore . DIRECTORY_SEPARATOR . $fontFileName . '.ufm';
+            if (!file_exists($expectedUfm)) {
+                $font = Font::load($fontFile);
+                $font->parse();
+                try {
+                    $font->saveAdobeFontMetrics($expectedUfm);
+                } catch (\Exception $exception) {
+                    throw new PdfExportException("Failed to create required font data at $expectedUfm, Ensure this location is writable by the web server");
+                }
+            }
+
+            $nameParts = explode('-', $fontFileName);
+            if (count($nameParts) === 1 || $nameParts[1] === 'Regular') {
+                $nameParts[1] = 'Normal';
+            }
+
+            $family = trim(strtolower(preg_replace('/([A-Z])/', ' $1', $nameParts[0])));
+            $variation = Str::snake($nameParts[1]);
+            if (!isset($fontFamilies[$family])) {
+                $fontFamilies[$family] = [];
+            }
+
+            $fontFamilies[$family][$variation] = $fontStore . DIRECTORY_SEPARATOR . $fontFileName;
+        }
+
+        return $fontFamilies;
+    }
+
     /**
      * @throws PdfExportException
      */

app/Exports/ZipExports/ZipImportRunner.php

@@ -48,7 +48,7 @@ class ZipImportRunner
      * Returns the top-level entity item which was imported.
      * @throws ZipImportException
      */
-    public function run(Import $import, ?Entity $parent = null): Entity
+    public function run(Import $import, Book|Chapter|null $parent = null): Entity
     {
         $zipPath = $this->getZipPath($import);
         $reader = new ZipExportReader($zipPath);

app/Http/Controller.php

@@ -7,6 +7,7 @@ use BookStack\App\Model;
 use BookStack\Exceptions\NotifyException;
 use BookStack\Facades\Activity;
 use BookStack\Permissions\Permission;
+use BookStack\Users\Models\OwnableInterface;
 use Illuminate\Foundation\Bus\DispatchesJobs;
 use Illuminate\Foundation\Validation\ValidatesRequests;
 use Illuminate\Http\JsonResponse;
@@ -80,7 +81,7 @@ abstract class Controller extends BaseController
     /**
      * Check the current user's permissions against an ownable item otherwise throw an exception.
      */
-    protected function checkOwnablePermission(string|Permission $permission, Model $ownable, string $redirectLocation = '/'): void
+    protected function checkOwnablePermission(string|Permission $permission, Model&OwnableInterface $ownable, string $redirectLocation = '/'): void
     {
         if (!userCan($permission, $ownable)) {
             $this->showPermissionError($redirectLocation);

app/Permissions/JointPermissionBuilder.php

@@ -101,6 +101,7 @@ class JointPermissionBuilder
 
     /**
      * Get a query for fetching a book with its children.
+     * @return Builder<Book>
      */
     protected function bookFetchQuery(): Builder
     {
@@ -117,9 +118,11 @@ class JointPermissionBuilder
 
     /**
      * Build joint permissions for the given book and role combinations.
+     * @param EloquentCollection<int, Book> $books
      */
     protected function buildJointPermissionsForBooks(EloquentCollection $books, array $roles, bool $deleteOld = false): void
     {
+        /** @var EloquentCollection<int, Entity> $entities */
         $entities = clone $books;
 
         /** @var Book $book */

app/References/Reference.php

@@ -2,8 +2,8 @@
 
 namespace BookStack\References;
 
+use BookStack\App\Model;
 use BookStack\Permissions\Models\JointPermission;
-use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
 

app/References/ReferenceFetcher.php

@@ -22,6 +22,7 @@ class ReferenceFetcher
      */
     public function getReferencesToEntity(Entity $entity, bool $withContents = false): Collection
     {
+        /** @var Collection<int, Reference> $references */
         $references = $this->queryReferencesToEntity($entity)->get();
         $this->mixedEntityListLoader->loadIntoRelations($references->all(), 'from', false, $withContents);
 
@@ -37,6 +38,9 @@ class ReferenceFetcher
         return $this->queryReferencesToEntity($entity)->count();
     }
 
+    /**
+     * @return Builder<Reference>
+     */
     protected function queryReferencesToEntity(Entity $entity): Builder
     {
         $baseQuery = Reference::query()

app/Search/SearchIndex.php

@@ -119,7 +119,7 @@ class SearchIndex
      * Create a scored term array from the given text, where the keys are the terms
      * and the values are their scores.
      *
-     * @return array<string, int>
+     * @return array<string, float>
      */
     protected function generateTermScoreMapFromText(string $text, float $scoreAdjustment = 1): array
     {
@@ -136,7 +136,7 @@ class SearchIndex
      * Create a scored term array from the given HTML, where the keys are the terms
      * and the values are their scores.
      *
-     * @return array<string, int>
+     * @return array<string, float>
      */
     protected function generateTermScoreMapFromHtml(string $html): array
     {
@@ -177,7 +177,7 @@ class SearchIndex
      *
      * @param Tag[] $tags
      *
-     * @return array<string, int>
+     * @return array<string, float>
      */
     protected function generateTermScoreMapFromTags(array $tags): array
     {
@@ -277,9 +277,9 @@ class SearchIndex
      * For the given term data arrays, Merge their contents by term
      * while combining any scores.
      *
-     * @param array<string, int>[] ...$scoreMaps
+     * @param array<string, float>[] ...$scoreMaps
      *
-     * @return array<string, int>
+     * @return array<string, float>
      */
     protected function mergeTermScoreMaps(...$scoreMaps): array
     {

app/Search/SearchRunner.php

@@ -4,6 +4,7 @@ namespace BookStack\Search;
 
 use BookStack\Entities\EntityProvider;
 use BookStack\Entities\Models\Entity;
+use BookStack\Entities\Models\EntityTable;
 use BookStack\Entities\Queries\EntityQueries;
 use BookStack\Entities\Tools\EntityHydrator;
 use BookStack\Permissions\PermissionApplicator;
@@ -90,6 +91,8 @@ class SearchRunner
 
     /**
      * Get a page of result data from the given query based on the provided page parameters.
+     * @param EloquentBuilder<EntityTable> $query
+     * @return Collection<Entity>
      */
     protected function getPageOfDataFromQuery(EloquentBuilder $query, int $page, int $count): Collection
     {
@@ -106,6 +109,7 @@ class SearchRunner
     /**
      * Create a search query for an entity.
      * @param string[] $entityTypes
+     * @return EloquentBuilder<EntityTable>
      */
     protected function buildQuery(SearchOptions $searchOpts, array $entityTypes): EloquentBuilder
     {
@@ -120,8 +124,14 @@ class SearchRunner
             $filter = function (EloquentBuilder $query) use ($exact) {
                 $inputTerm = str_replace('\\', '\\\\', $exact->value);
                 $query->where('name', 'like', '%' . $inputTerm . '%')
-                    ->orWhere('description', 'like', '%' . $inputTerm . '%')
+                    ->orWhere(function (EloquentBuilder $query) use ($inputTerm) {
-                    ->orWhere('text', 'like', '%' . $inputTerm . '%');
+                        $query->whereNotNull('description')
+                            ->where('description', 'like', '%' . $inputTerm . '%');
+                    })
+                    ->orWhere(function (EloquentBuilder $query) use ($inputTerm) {
+                        $query->whereNotNull('text')
+                            ->where('text', 'like', '%' . $inputTerm . '%');
+                    });
             };
 
             $exact->negated ? $entityQuery->whereNot($filter) : $entityQuery->where($filter);

app/Settings/SettingService.php

@@ -243,9 +243,9 @@ class SettingService
     /**
      * Convert a setting key into a user-specific key.
      */
-    protected function userKey(string $userId, string $key = ''): string
+    protected function userKey(int $userId, string $key = ''): string
     {
-        return 'user:' . $userId . ':' . $key;
+        return 'user:' . strval($userId) . ':' . $key;
     }
 
     /**
@@ -267,7 +267,7 @@ class SettingService
     /**
      * Delete settings for a given user id.
      */
-    public function deleteUserSettings(string $userId): void
+    public function deleteUserSettings(int $userId): void
     {
         Setting::query()
             ->where('setting_key', 'like', $this->userKey($userId) . '%')

app/Sorting/SortRule.php

@@ -38,21 +38,35 @@ class SortRule extends Model implements Loggable
         $this->sequence = implode(',', $values);
     }
 
+    /**
+     * @inheritDoc
+     */
     public function logDescriptor(): string
     {
         return "({$this->id}) {$this->name}";
     }
 
+    /**
+     * Get the URL to where this rule can be managed.
+     */
     public function getUrl(): string
     {
         return url("/settings/sorting/rules/{$this->id}");
     }
 
+    /**
+     * Get the books which are specifically set to use this sort rule.
+     * @return HasMany<Book, $this>
+     */
     public function books(): HasMany
     {
         return $this->hasMany(Book::class, 'entity_container_data.sort_rule_id', 'id');
     }
 
+    /**
+     * Get all the available sort rules, ordered by name, with the number of books using each.
+     * @return Collection<SortRule>
+     */
     public static function allByName(): Collection
     {
         return static::query()

app/Translation/LocaleManager.php

@@ -64,6 +64,7 @@ class LocaleManager
         'sq'          => 'sq_AL',
         'sr'          => 'sr_RS',
         'sv'          => 'sv_SE',
+        'th'          => 'th_TH',
         'tk'          => 'tk_TM',
         'tr'          => 'tr_TR',
         'uk'          => 'uk_UA',

app/Uploads/AttachmentService.php

@@ -102,7 +102,7 @@ class AttachmentService
     /**
      * Updates the ordering for a listing of attached files.
      */
-    public function updateFileOrderWithinPage(array $attachmentOrder, string $pageId)
+    public function updateFileOrderWithinPage(array $attachmentOrder, int $pageId)
     {
         foreach ($attachmentOrder as $index => $attachmentId) {
             Attachment::query()->where('uploaded_to', '=', $pageId)

app/Uploads/Controllers/AttachmentController.php

@@ -195,6 +195,7 @@ class AttachmentController extends Controller
         $this->validate($request, [
             'order' => ['required', 'array'],
         ]);
+
         $page = $this->pageQueries->findVisibleByIdOrFail($pageId);
         $this->checkOwnablePermission(Permission::PageUpdate, $page);
 
@@ -221,8 +222,6 @@ class AttachmentController extends Controller
             throw new NotFoundException(trans('errors.attachment_not_found'));
         }
 
-        $this->checkOwnablePermission(Permission::PageView, $page);
-
         if ($attachment->external) {
             return redirect($attachment->path);
         }
@@ -247,6 +246,13 @@ class AttachmentController extends Controller
     {
         /** @var Attachment $attachment */
         $attachment = Attachment::query()->findOrFail($attachmentId);
+
+        try {
+            $this->pageQueries->findVisibleByIdOrFail($attachment->uploaded_to);
+        } catch (NotFoundException $exception) {
+            throw new NotFoundException(trans('errors.attachment_not_found'));
+        }
+
         $this->checkOwnablePermission(Permission::AttachmentDelete, $attachment);
         $this->attachmentService->deleteFile($attachment);
 

app/Uploads/Controllers/DrawioImageController.php

@@ -2,6 +2,7 @@
 
 namespace BookStack\Uploads\Controllers;
 
+use BookStack\Entities\Queries\PageQueries;
 use BookStack\Exceptions\ImageUploadException;
 use BookStack\Http\Controller;
 use BookStack\Permissions\Permission;
@@ -14,7 +15,8 @@ use Illuminate\Http\Request;
 class DrawioImageController extends Controller
 {
     public function __construct(
-        protected ImageRepo $imageRepo
+        protected ImageRepo $imageRepo,
+        protected PageQueries $pageQueries,
     ) {
     }
 
@@ -53,16 +55,18 @@ class DrawioImageController extends Controller
      */
     public function create(Request $request)
     {
-        $this->validate($request, [
+        $this->checkPermission(Permission::ImageCreateAll);
+        $validated = $this->validate($request, [
             'image'       => ['required', 'string'],
             'uploaded_to' => ['required', 'integer'],
         ]);
 
-        $this->checkPermission(Permission::ImageCreateAll);
+        $imageBase64Data = $validated['image'];
-        $imageBase64Data = $request->input('image');
+        $uploadedTo = $validated['uploaded_to'];
+        $targetPage = $this->pageQueries->findVisibleByIdOrFail($uploadedTo);
+        $this->checkOwnablePermission(Permission::PageUpdate, $targetPage);
 
         try {
-            $uploadedTo = $request->input('uploaded_to', 0);
             $image = $this->imageRepo->saveDrawing($imageBase64Data, $uploadedTo);
         } catch (ImageUploadException $e) {
             return response($e->getMessage(), 500);

app/Uploads/Controllers/GalleryImageController.php

@@ -2,6 +2,7 @@
 
 namespace BookStack\Uploads\Controllers;
 
+use BookStack\Entities\Queries\PageQueries;
 use BookStack\Exceptions\ImageUploadException;
 use BookStack\Http\Controller;
 use BookStack\Permissions\Permission;
@@ -14,7 +15,8 @@ use Illuminate\Validation\ValidationException;
 class GalleryImageController extends Controller
 {
     public function __construct(
-        protected ImageRepo $imageRepo
+        protected ImageRepo $imageRepo,
+        protected PageQueries $pageQueries,
     ) {
     }
 
@@ -56,20 +58,26 @@ class GalleryImageController extends Controller
         $this->checkPermission(Permission::ImageCreateAll);
 
         try {
-            $this->validate($request, [
+            $validated = $this->validate($request, [
                 'file' => $this->getImageValidationRules(),
+                'uploaded_to' => ['required', 'integer'],
             ]);
         } catch (ValidationException $exception) {
-            return $this->jsonError(implode("\n", $exception->errors()['file']));
+            $errors = $exception->errors();
+            $messages = array_merge($errors['file'] ?? [], $errors['uploaded_to'] ?? []);
+            return $this->jsonError(implode("\n", $messages));
         }
 
+        $uploadedTo = intval($validated['uploaded_to']);
+        $targetPage = $this->pageQueries->findVisibleByIdOrFail($uploadedTo);
+        $this->checkOwnablePermission(Permission::PageUpdate, $targetPage);
+
         new OutOfMemoryHandler(function () {
             return $this->jsonError(trans('errors.image_upload_memory_limit'));
         });
 
         try {
-            $imageUpload = $request->file('file');
+            $imageUpload = $validated['file'];
-            $uploadedTo = $request->input('uploaded_to', 0);
             $image = $this->imageRepo->saveNew($imageUpload, 'gallery', $uploadedTo);
         } catch (ImageUploadException $e) {
             return response($e->getMessage(), 500);

app/Uploads/Controllers/ImageGalleryApiController.php

@@ -75,6 +75,7 @@ class ImageGalleryApiController extends ApiController
         $this->checkPermission(Permission::ImageCreateAll);
         $data = $this->validate($request, $this->rules()['create']);
         $page = $this->pageQueries->findVisibleByIdOrFail($data['uploaded_to']);
+        $this->checkOwnablePermission(Permission::PageUpdate, $page);
 
         $image = $this->imageRepo->saveNew($data['image'], $data['type'], $page->id);
 

app/Users/Controllers/RoleApiController.php

@@ -87,7 +87,7 @@ class RoleApiController extends ApiController
      */
     public function read(string $id)
     {
-        $role = $this->permissionsRepo->getRoleById($id);
+        $role = $this->permissionsRepo->getRoleById(intval($id));
         $this->singleFormatter($role);
 
         return response()->json($role);

app/Users/Controllers/RoleController.php

@@ -94,7 +94,7 @@ class RoleController extends Controller
     public function edit(string $id)
     {
         $this->checkPermission(Permission::UserRolesManage);
-        $role = $this->permissionsRepo->getRoleById($id);
+        $role = $this->permissionsRepo->getRoleById(intval($id));
 
         $this->setPageTitle(trans('settings.role_edit'));
 
@@ -129,7 +129,7 @@ class RoleController extends Controller
     public function showDelete(string $id)
     {
         $this->checkPermission(Permission::UserRolesManage);
-        $role = $this->permissionsRepo->getRoleById($id);
+        $role = $this->permissionsRepo->getRoleById(intval($id));
         $roles = $this->permissionsRepo->getAllRolesExcept($role);
         $blankRole = $role->newInstance(['display_name' => trans('settings.role_delete_no_migration')]);
         $roles->prepend($blankRole);
@@ -151,7 +151,7 @@ class RoleController extends Controller
 
         try {
             $migrateRoleId = intval($request->input('migrate_role_id') ?: "0");
-            $this->permissionsRepo->deleteRole($id, $migrateRoleId);
+            $this->permissionsRepo->deleteRole(intval($id), $migrateRoleId);
         } catch (PermissionsException $e) {
             $this->showErrorNotification($e->getMessage());
 

app/Users/Controllers/UserApiController.php

@@ -110,7 +110,7 @@ class UserApiController extends ApiController
      */
     public function read(string $id)
     {
-        $user = $this->userRepo->getById($id);
+        $user = $this->userRepo->getById(intval($id));
         $this->singleFormatter($user);
 
         return response()->json($user);
@@ -124,8 +124,8 @@ class UserApiController extends ApiController
      */
     public function update(Request $request, string $id)
     {
-        $data = $this->validate($request, $this->rules($id)['update']);
+        $data = $this->validate($request, $this->rules(intval($id))['update']);
-        $user = $this->userRepo->getById($id);
+        $user = $this->userRepo->getById(intval($id));
         $this->userRepo->update($user, $data, userCan(Permission::UsersManage));
         $this->singleFormatter($user);
 
@@ -140,7 +140,7 @@ class UserApiController extends ApiController
      */
     public function delete(Request $request, string $id)
     {
-        $user = $this->userRepo->getById($id);
+        $user = $this->userRepo->getById(intval($id));
         $newOwnerId = $request->input('migrate_ownership_id', null);
 
         $this->userRepo->destroy($user, $newOwnerId);

app/Users/Controllers/UserController.php

@@ -4,6 +4,7 @@ namespace BookStack\Users\Controllers;
 
 use BookStack\Access\SocialDriverManager;
 use BookStack\Access\UserInviteException;
+use BookStack\Activity\ActivityType;
 use BookStack\Exceptions\ImageUploadException;
 use BookStack\Exceptions\UserUpdateException;
 use BookStack\Http\Controller;
@@ -208,4 +209,20 @@ class UserController extends Controller
 
         return redirect('/settings/users');
     }
+
+    /**
+     * Reset MFA for the specified user.
+     */
+    public function resetMfa(Request $request, int $id)
+    {
+        $this->preventAccessInDemoMode();
+        $this->checkPermission(Permission::UsersManage);
+
+        $user = $this->userRepo->getById($id);
+        $user->mfaValues()->delete();
+
+        $this->logActivity(ActivityType::USER_MFA_RESET, $user);
+
+        return redirect("/settings/users/{$user->id}");
+    }
 }

app/Util/CspService.php

@@ -30,6 +30,8 @@ class CspService
             $this->getFrameAncestors(),
             $this->getFrameSrc(),
             $this->getScriptSrc(),
+            $this->getStyleSrc(),
+            $this->getImgSrc(),
             $this->getObjectSrc(),
             $this->getBaseUri(),
         ];
@@ -45,6 +47,8 @@ class CspService
         $headers = [
             $this->getFrameSrc(),
             $this->getScriptSrc(),
+            $this->getStyleSrc(),
+            $this->getImgSrc(),
             $this->getObjectSrc(),
             $this->getBaseUri(),
         ];
@@ -115,6 +119,22 @@ class CspService
         return "object-src 'self'";
     }
 
+    /**
+     * Creates CSP 'style-src' rule to restrict where styles can be loaded from.
+     */
+    protected function getStyleSrc(): string
+    {
+        return 'style-src ' . implode(' ', $this->getAllowedStyleSources());
+    }
+
+    /**
+     * Creates CSP 'img-src' rule to restrict where images can be loaded from.
+     */
+    protected function getImgSrc(): string
+    {
+        return 'img-src ' . implode(' ', $this->getAllowedImageSources());
+    }
+
     /**
      * Creates CSP 'base-uri' rule to restrict what base tags can be set on
      * the page to prevent manipulation of relative links.
@@ -144,6 +164,59 @@ class CspService
         return array_filter($sources);
     }
 
+    /**
+     * Get allowed style sources for the style-src directive.
+     */
+    protected function getAllowedStyleSources(): array
+    {
+        $configured = config('app.style_sources');
+
+        if (is_string($configured)) {
+            $sources = array_filter(explode(' ', $configured));
+            array_unshift($sources, "'self'");
+
+            // Ensure 'unsafe-inline' is quoted if present
+            // This is done as attempting to pass this in env values with quotes can either
+            // be awkward or cause issues.
+            $unsafeInlineIndex = array_search('unsafe-inline', $sources, true);
+            if ($unsafeInlineIndex !== false) {
+                $sources[$unsafeInlineIndex] = "'unsafe-inline'";
+            }
+
+            return array_values(array_unique($sources));
+        }
+
+        return [
+            "'self'",
+            "'unsafe-inline'",
+            'http:',
+            'https:',
+        ];
+    }
+
+    /**
+     * Get allowed image sources for the img-src directive.
+     */
+    protected function getAllowedImageSources(): array
+    {
+        $configured = config('app.image_sources');
+
+        if (is_string($configured)) {
+            $sources = array_filter(explode(' ', $configured));
+            array_unshift($sources, "'self'", 'blob:', 'data:');
+
+            return array_values(array_unique($sources));
+        }
+
+        return [
+            "'self'",
+            'data:',
+            'blob:',
+            'http:',
+            'https:',
+        ];
+    }
+
     /**
      * Extract the host name of the configured drawio URL for use in CSP.
      * Returns empty string if not in use.

app/Util/DatabaseTransaction.php

@@ -3,6 +3,7 @@
 namespace BookStack\Util;
 
 use Closure;
+use Illuminate\Database\Connection;
 use Illuminate\Support\Facades\DB;
 use Throwable;
 
@@ -24,7 +25,7 @@ use Throwable;
 class DatabaseTransaction
 {
     /**
-     * @param  (Closure(static): TReturn)  $callback
+     * @param  (Closure(Connection): TReturn)  $callback
      */
     public function __construct(
         protected Closure $callback

app/Util/SsrUrlValidator.php

@@ -8,6 +8,10 @@ use BookStack\Exceptions\HttpFetchException;
  * Validate the host we're connecting to when making a server-side-request.
  * Will use the given hosts config if given during construction otherwise
  * will look to the app configured config.
+ *
+ * The config format is a space-seperated list of URL prefixes which should contain the
+ * protocol and host. It can optionally define a path prefix as part of the URL.
+ * Wildcards, via a '*', can be used within these elements to match anything but a '/'.
  */
 class SsrUrlValidator
 {
@@ -48,15 +52,34 @@ class SsrUrlValidator
     {
         $pattern = rtrim(trim($pattern), '/');
         $url = trim($url);
+        $urlParts = parse_url($url);
 
-        if (empty($pattern) || empty($url)) {
+        if (empty($pattern) || empty($url) || $urlParts === false) {
             return false;
         }
 
-        $quoted = preg_quote($pattern, '/');
+        // Prevent potential tricks using percent encoded slashes
-        $regexPattern = str_replace('\*', '.*', $quoted);
+        if (str_contains(strtolower($urlParts['host'] ?? ''), '%2f')) {
+            return false;
+        }
 
-        return preg_match('/^' . $regexPattern . '($|\/.*$|#.*$)/i', $url);
+        // Disregard query and fragment
+        $url = explode('?', $url, 2)[0];
+        $url = explode('#', $url, 2)[0];
+
+        // Disregard userinfo if existing
+        if (!empty($urlParts['user']) || !empty($urlParts['pass'])) {
+            [$start, $postUserinfo] = explode('@', $url, 2);
+            $preUserinfo = explode('//', $start, 2)[0];
+            $url = ($preUserinfo ? $preUserinfo . '//' : '') . $postUserinfo;
+        }
+
+        // Prepare pattern
+        $quoted = preg_quote($pattern, '/');
+        $regexPattern = str_replace('\*', '[^\/]*', $quoted);
+
+        // Check against our URL
+        return preg_match('/^' . $regexPattern . '($|\/.*$)/i', $url);
     }
 
     /**

crowdin.yml

@@ -1,10 +1,13 @@
 project_id: "377219"
 project_identifier: bookstack
+api_token_env: CROWDIN_PERSONAL_TOKEN
+
 base_path: .
 preserve_hierarchy: false
 pull_request_title: Updated translations with latest Crowdin changes
 pull_request_labels:
-  - ":earth_africa: Translations"
+  - "Translations"
+
 files:
   - source: /lang/en/*.php
     translation: /lang/%two_letters_code%/%original_file_name%

dev/docker/db-testing/Dockerfile

@@ -18,7 +18,7 @@ ARG BRANCH=development
 
 # Download BookStack & install PHP deps
 RUN mkdir -p /var/www && \
-    git clone https://github.com/bookstackapp/bookstack.git --branch "$BRANCH" --single-branch /var/www/bookstack && \
+    git clone https://codeberg.org/bookstack/bookstack.git --branch "$BRANCH" --single-branch /var/www/bookstack && \
     cd /var/www/bookstack && \
     wget https://raw.githubusercontent.com/composer/getcomposer.org/f3108f64b4e1c1ce6eb462b159956461592b3e3e/web/installer -O - -q | php -- --quiet --filename=composer && \
     php composer install

dev/docs/logical-theme-system.md

@@ -74,7 +74,7 @@ Theme::registerCommand(new SayHelloCommand());
 
 ## Available Events
 
-All available events dispatched by BookStack are exposed as static properties on the `\BookStack\Theming\ThemeEvents` class, which can be found within the file `app/Theming/ThemeEvents.php` relative to your root BookStack folder. Alternatively, the events for the latest release can be [seen on GitHub here](https://github.com/BookStackApp/BookStack/blob/release/app/Theming/ThemeEvents.php).
+All available events dispatched by BookStack are exposed as static properties on the `\BookStack\Theming\ThemeEvents` class, which can be found within the file `app/Theming/ThemeEvents.php` relative to your root BookStack folder. Alternatively, the events for the latest release can be [seen on Codeberg here](https://codeberg.org/bookstack/bookstack/src/branch/release/app/Theming/ThemeEvents.php).
 
 The comments above each constant with the `ThemeEvents.php` file describe the dispatch conditions of the event, in addition to the arguments the action will receive. The comments may also describe any ways the return value of the action may be used. 
 

dev/docs/release-process.md

@@ -12,13 +12,13 @@ Feature releases are generally larger, bringing new features in addition to fixe
 
 ### Release Planning Process
 
-Each BookStack release will have a [milestone](https://github.com/BookStackApp/BookStack/milestones) created with issues & pull requests assigned to it to define what will be in that release. Milestones are built up then worked through until complete at which point, after some testing and documentation updates, the release will be deployed.
+Each BookStack release will have a [milestone](https://codeberg.org/bookstack/bookstack/milestones) created with issues & pull requests assigned to it to define what will be in that release. Milestones are built up then worked through until complete at which point, after some testing and documentation updates, the release will be deployed.
 
 ### Release Announcements
 
-Feature releases, and some patch releases, will be accompanied by a post on the [BookStack blog](https://www.bookstackapp.com/blog/) which will provide additional detail on features, changes & updates otherwise the [GitHub release page](https://github.com/BookStackApp/BookStack/releases) will show a list of changes. You can sign up to be alerted to new BookStack blog posts (once per week maximum) [at this link](https://updates.bookstackapp.com/signup/bookstack-news-and-updates).
+Feature releases, and some patch releases, will be accompanied by a post on the [BookStack blog](https://www.bookstackapp.com/blog/) which will provide additional detail on features, changes & updates otherwise the [Codeberg release page](https://codeberg.org/bookstack/bookstack/releases) will show a list of changes. You can sign up to be alerted to new BookStack blog posts (once per week maximum) [at this link](https://updates.bookstackapp.com/signup/bookstack-news-and-updates).
 
 ### Release Technical Process
 
 Deploying a release, at a high level, simply involves merging the development branch into the release branch before then building & committing any release-only assets.
-A helper script [can be found in our](https://github.com/BookStackApp/devops/blob/main/meta-scripts/bookstack-release-steps) devops repo which provides the steps and commands for deploying a new release. 
+A helper script [can be found in our](https://codeberg.org/bookstack/devops/src/branch/main/meta-scripts/bookstack-release-steps) devops repo which provides the steps and commands for deploying a new release. 

dev/docs/wysiwyg-js-api.md

@@ -2,7 +2,7 @@
 
 **Warning: This API is currently in development and may change without notice.**
 
-Feedback is very much welcomed via this issue: https://github.com/BookStackApp/BookStack/issues/5937
+Feedback is very much welcomed via this issue: https://codeberg.org/bookstack/bookstack/issues/5937
 
 This document covers the JavaScript API for the (newer Lexical-based) WYSIWYG editor.
 This API is built and designed to abstract the internals of the editor away

dev/licensing/js-library-licenses.txt

@@ -69,8 +69,9 @@ Source: zeit/arg
 Link: zeit/arg
 -----------
 argparse
-License: Python-2.0
+License: MIT
 License File: node_modules/argparse/LICENSE
+Copyright: Copyright (C) 2012 by Vitaly Puzrin
 Source: nodeca/argparse
 Link: nodeca/argparse
 -----------
@@ -81,34 +82,6 @@ Copyright: Copyright (c) 2023 Inspect JS
 Source: git+https://github.com/inspect-js/array-buffer-byte-length.git
 Link: https://github.com/inspect-js/array-buffer-byte-length#readme
 -----------
-array-includes
-License: MIT
-License File: node_modules/array-includes/LICENSE
-Copyright: Copyright (C) 2015 Jordan Harband
-Source: git://github.com/es-shims/array-includes.git
-Link: git://github.com/es-shims/array-includes.git
------------
-array.prototype.findlastindex
-License: MIT
-License File: node_modules/array.prototype.findlastindex/LICENSE
-Copyright: Copyright (c) 2021 ECMAScript Shims
-Source: git+https://github.com/es-shims/Array.prototype.findLastIndex.git
-Link: https://github.com/es-shims/Array.prototype.findLastIndex#readme
------------
-array.prototype.flat
-License: MIT
-License File: node_modules/array.prototype.flat/LICENSE
-Copyright: Copyright (c) 2017 ECMAScript Shims
-Source: git://github.com/es-shims/Array.prototype.flat.git
-Link: git://github.com/es-shims/Array.prototype.flat.git
------------
-array.prototype.flatmap
-License: MIT
-License File: node_modules/array.prototype.flatmap/LICENSE
-Copyright: Copyright (c) 2017 ECMAScript Shims
-Source: git://github.com/es-shims/Array.prototype.flatMap.git
-Link: git://github.com/es-shims/Array.prototype.flatMap.git
------------
 arraybuffer.prototype.slice
 License: MIT
 License File: node_modules/arraybuffer.prototype.slice/LICENSE
@@ -169,9 +142,14 @@ Link: https://github.com/jestjs/jest.git
 balanced-match
 License: MIT
 License File: node_modules/balanced-match/LICENSE.md
-Copyright: Copyright (c) 2013 Julian Gruber <******@************.***>
 Source: git://github.com/juliangruber/balanced-match.git
-Link: https://github.com/juliangruber/balanced-match
+Link: git://github.com/juliangruber/balanced-match.git
+-----------
+baseline-browser-mapping
+License: Apache-2.0
+License File: node_modules/baseline-browser-mapping/LICENSE.txt
+Source: git+https://github.com/web-platform-dx/baseline-browser-mapping.git
+Link: git+https://github.com/web-platform-dx/baseline-browser-mapping.git
 -----------
 binary-extensions
 License: MIT
@@ -184,9 +162,8 @@ Link: sindresorhus/binary-extensions
 brace-expansion
 License: MIT
 License File: node_modules/brace-expansion/LICENSE
-Copyright: Copyright (c) 2013 Julian Gruber <******@************.***>
+Source: git+ssh://git@github.com/juliangruber/brace-expansion.git
-Source: git://github.com/juliangruber/brace-expansion.git
+Link: git+ssh://git@github.com/juliangruber/brace-expansion.git
-Link: https://github.com/juliangruber/brace-expansion
 -----------
 braces
 License: MIT
@@ -472,8 +449,8 @@ Link: git://github.com/ljharb/define-properties.git
 detect-libc
 License: Apache-2.0
 License File: node_modules/detect-libc/LICENSE
-Source: git://github.com/lovell/detect-libc
+Source: git://github.com/lovell/detect-libc.git
-Link: git://github.com/lovell/detect-libc
+Link: git://github.com/lovell/detect-libc.git
 -----------
 detect-newline
 License: MIT
@@ -489,12 +466,6 @@ Copyright: Copyright (c) 2009-2015, Kevin Decker <********@*****.***>
 Source: git://github.com/kpdecker/jsdiff.git
 Link: git://github.com/kpdecker/jsdiff.git
 -----------
-doctrine
-License: Apache-2.0
-License File: node_modules/doctrine/LICENSE
-Source: eslint/doctrine
-Link: https://github.com/eslint/doctrine
------------
 dunder-proto
 License: MIT
 License File: node_modules/dunder-proto/LICENSE
@@ -511,8 +482,8 @@ electron-to-chromium
 License: ISC
 License File: node_modules/electron-to-chromium/LICENSE
 Copyright: Copyright 2018 Kilian Valkhof
-Source: https://github.com/kilian/electron-to-chromium/
+Source: git+https://github.com/kilian/electron-to-chromium.git
-Link: https://github.com/kilian/electron-to-chromium/
+Link: git+https://github.com/kilian/electron-to-chromium.git
 -----------
 emittery
 License: MIT
@@ -577,13 +548,6 @@ Copyright: Copyright (c) 2022 ECMAScript Shims
 Source: git+https://github.com/es-shims/es-set-tostringtag.git
 Link: https://github.com/es-shims/es-set-tostringtag#readme
 -----------
-es-shim-unscopables
-License: MIT
-License File: node_modules/es-shim-unscopables/LICENSE
-Copyright: Copyright (c) 2022 Jordan Harband
-Source: git+https://github.com/ljharb/es-shim-unscopables.git
-Link: https://github.com/ljharb/es-shim-unscopables#readme
------------
 es-to-primitive
 License: MIT
 License File: node_modules/es-to-primitive/LICENSE
@@ -612,27 +576,6 @@ Copyright: Copyright (c) Sindre Sorhus <************@*****.***> (https://sindres
 Source: sindresorhus/escape-string-regexp
 Link: sindresorhus/escape-string-regexp
 -----------
-eslint-import-resolver-node
-License: MIT
-License File: node_modules/eslint-import-resolver-node/LICENSE
-Copyright: Copyright (c) 2015 Ben Mosher
-Source: https://github.com/import-js/eslint-plugin-import
-Link: https://github.com/import-js/eslint-plugin-import
------------
-eslint-module-utils
-License: MIT
-License File: node_modules/eslint-module-utils/LICENSE
-Copyright: Copyright (c) 2015 Ben Mosher
-Source: git+https://github.com/import-js/eslint-plugin-import.git
-Link: https://github.com/import-js/eslint-plugin-import#readme
------------
-eslint-plugin-import
-License: MIT
-License File: node_modules/eslint-plugin-import/LICENSE
-Copyright: Copyright (c) 2015 Ben Mosher
-Source: https://github.com/import-js/eslint-plugin-import
-Link: https://github.com/import-js/eslint-plugin-import
------------
 eslint-scope
 License: BSD-2-Clause
 License File: node_modules/eslint-scope/LICENSE
@@ -814,6 +757,13 @@ Copyright: Copyright (c) 2019 Jordan Harband
 Source: git+https://github.com/inspect-js/functions-have-names.git
 Link: https://github.com/inspect-js/functions-have-names#readme
 -----------
+generator-function
+License: MIT
+License File: node_modules/generator-function/LICENSE.md
+Copyright: Copyright (c) 2015 Tiancheng “Timothy” Gu
+Source: git+https://github.com/TimothyGu/generator-function.git
+Link: https://github.com/TimothyGu/generator-function#readme
+-----------
 gensync
 License: MIT
 License File: node_modules/gensync/LICENSE
@@ -1026,13 +976,6 @@ Copyright: Copyright (c) 2014-present, Lee Byron and other contributors.
 Source: git://github.com/immutable-js/immutable-js.git
 Link: https://immutable-js.com
 -----------
-import-fresh
-License: MIT
-License File: node_modules/import-fresh/license
-Copyright: Copyright (c) Sindre Sorhus <************@*****.***> (https://sindresorhus.com)
-Source: sindresorhus/import-fresh
-Link: sindresorhus/import-fresh
------------
 import-local
 License: MIT
 License File: node_modules/import-local/license
@@ -1529,7 +1472,7 @@ License: MIT
 License File: node_modules/js-yaml/LICENSE
 Copyright: Copyright (C) 2011-2015 by Vitaly Puzrin
 Source: nodeca/js-yaml
-Link: nodeca/js-yaml
+Link: https://github.com/nodeca/js-yaml
 -----------
 jsdom
 License: MIT
@@ -1645,12 +1588,6 @@ License File: node_modules/lodash.memoize/LICENSE
 Source: lodash/lodash
 Link: https://lodash.com/
 -----------
-lodash.merge
-License: MIT
-License File: node_modules/lodash.merge/LICENSE
-Source: lodash/lodash
-Link: https://lodash.com/
------------
 lodash.throttle
 License: MIT
 License File: node_modules/lodash.throttle/LICENSE
@@ -1741,11 +1678,10 @@ Source: sindresorhus/mimic-fn
 Link: sindresorhus/mimic-fn
 -----------
 minimatch
-License: ISC
+License: BlueOak-1.0.0
-License File: node_modules/minimatch/LICENSE
+License File: node_modules/minimatch/LICENSE.md
-Copyright: Copyright (c) Isaac Z. Schlueter and Contributors
+Source: git@github.com:isaacs/minimatch
-Source: git://github.com/isaacs/minimatch.git
+Link: git@github.com:isaacs/minimatch
-Link: git://github.com/isaacs/minimatch.git
 -----------
 minimist
 License: MIT
@@ -1754,9 +1690,8 @@ Source: git://github.com/minimistjs/minimist.git
 Link: https://github.com/minimistjs/minimist
 -----------
 minipass
-License: ISC
+License: BlueOak-1.0.0
-License File: node_modules/minipass/LICENSE
+License File: node_modules/minipass/LICENSE.md
-Copyright: Copyright (c) 2017-2023 npm, Inc., Isaac Z. Schlueter, and Contributors
 Source: https://github.com/isaacs/minipass
 Link: https://github.com/isaacs/minipass
 -----------
@@ -1872,27 +1807,6 @@ Copyright: Copyright (c) 2014 Jordan Harband
 Source: git://github.com/ljharb/object.assign.git
 Link: git://github.com/ljharb/object.assign.git
 -----------
-object.fromentries
-License: MIT
-License File: node_modules/object.fromentries/LICENSE
-Copyright: Copyright (c) 2018 Jordan Harband
-Source: git://github.com/es-shims/Object.fromEntries.git
-Link: git://github.com/es-shims/Object.fromEntries.git
------------
-object.groupby
-License: MIT
-License File: node_modules/object.groupby/LICENSE
-Copyright: Copyright (c) 2023 ECMAScript Shims
-Source: git+https://github.com/es-shims/Object.groupBy.git
-Link: https://github.com/es-shims/Object.groupBy#readme
------------
-object.values
-License: MIT
-License File: node_modules/object.values/LICENSE
-Copyright: Copyright (c) 2015 Jordan Harband
-Source: git://github.com/es-shims/Object.values.git
-Link: git://github.com/es-shims/Object.values.git
------------
 once
 License: ISC
 License File: node_modules/once/LICENSE
@@ -1948,13 +1862,6 @@ License File: node_modules/package-json-from-dist/LICENSE.md
 Source: git+https://github.com/isaacs/package-json-from-dist.git
 Link: git+https://github.com/isaacs/package-json-from-dist.git
 -----------
-parent-module
-License: MIT
-License File: node_modules/parent-module/license
-Copyright: Copyright (c) Sindre Sorhus <************@*****.***> (sindresorhus.com)
-Source: sindresorhus/parent-module
-Link: sindresorhus/parent-module
------------
 parse-json
 License: MIT
 License File: node_modules/parse-json/license
@@ -2159,8 +2066,8 @@ resolve
 License: MIT
 License File: node_modules/resolve/LICENSE
 Copyright: Copyright (c) 2012 James Halliday
-Source: git://github.com/browserify/resolve.git
+Source: ssh://github.com/browserify/resolve.git
-Link: git://github.com/browserify/resolve.git
+Link: ssh://github.com/browserify/resolve.git
 -----------
 rrweb-cssom
 License: MIT
@@ -2405,7 +2312,7 @@ Link: sindresorhus/string-width
 string-width
 License: MIT
 License File: node_modules/string-width/license
-Copyright: Copyright (c) Sindre Sorhus <************@*****.***> (sindresorhus.com)
+Copyright: Copyright (c) Sindre Sorhus <************@*****.***> (https://sindresorhus.com)
 Source: sindresorhus/string-width
 Link: sindresorhus/string-width
 -----------
@@ -2570,13 +2477,6 @@ Copyright: Copyright (c) 2014 Blake Embrey (*****@***********.***)
 Source: git://github.com/TypeStrong/ts-node.git
 Link: https://typestrong.org/ts-node
 -----------
-tsconfig-paths
-License: MIT
-License File: node_modules/tsconfig-paths/LICENSE
-Copyright: Copyright (c) 2016 Jonas Kello
-Source: https://github.com/dividab/tsconfig-paths
-Link: https://github.com/dividab/tsconfig-paths
------------
 type-check
 License: MIT
 License File: node_modules/type-check/LICENSE
@@ -2810,7 +2710,7 @@ Link: chalk/wrap-ansi
 wrap-ansi
 License: MIT
 License File: node_modules/wrap-ansi/license
-Copyright: Copyright (c) Sindre Sorhus <************@*****.***> (sindresorhus.com)
+Copyright: Copyright (c) Sindre Sorhus <************@*****.***> (https://sindresorhus.com)
 Source: chalk/wrap-ansi
 Link: chalk/wrap-ansi
 -----------
@@ -2892,12 +2792,6 @@ Copyright: Copyright (c) Sindre Sorhus <************@*****.***> (https://sindres
 Source: sindresorhus/yocto-queue
 Link: sindresorhus/yocto-queue
 -----------
-@ampproject/remapping
-License: Apache-2.0
-License File: node_modules/@ampproject/remapping/LICENSE
-Source: git+https://github.com/ampproject/remapping.git
-Link: git+https://github.com/ampproject/remapping.git
------------
 @asamuzakjp/css-color
 License: MIT
 License File: node_modules/@asamuzakjp/css-color/LICENSE
@@ -3172,15 +3066,15 @@ Link: https://demurgos.github.io/v8-coverage
 License: MIT
 License File: node_modules/@codemirror/autocomplete/LICENSE
 Copyright: Copyright (C) 2018-2021 by Marijn Haverbeke <******@*********.******> and others
-Source: https://github.com/codemirror/autocomplete.git
+Source: git+https://github.com/codemirror/autocomplete.git
-Link: https://github.com/codemirror/autocomplete.git
+Link: git+https://github.com/codemirror/autocomplete.git
 -----------
 @codemirror/commands
 License: MIT
 License File: node_modules/@codemirror/commands/LICENSE
 Copyright: Copyright (C) 2018-2021 by Marijn Haverbeke <******@*********.******> and others
-Source: https://github.com/codemirror/commands.git
+Source: git+https://github.com/codemirror/commands.git
-Link: https://github.com/codemirror/commands.git
+Link: git+https://github.com/codemirror/commands.git
 -----------
 @codemirror/lang-css
 License: MIT
@@ -3200,8 +3094,8 @@ Link: https://github.com/codemirror/lang-html.git
 License: MIT
 License File: node_modules/@codemirror/lang-javascript/LICENSE
 Copyright: Copyright (C) 2018-2021 by Marijn Haverbeke <******@*********.******> and others
-Source: https://github.com/codemirror/lang-javascript.git
+Source: git+https://github.com/codemirror/lang-javascript.git
-Link: https://github.com/codemirror/lang-javascript.git
+Link: git+https://github.com/codemirror/lang-javascript.git
 -----------
 @codemirror/lang-json
 License: MIT
@@ -3235,8 +3129,8 @@ Link: https://github.com/codemirror/lang-xml.git
 License: MIT
 License File: node_modules/@codemirror/language/LICENSE
 Copyright: Copyright (C) 2018-2021 by Marijn Haverbeke <******@*********.******> and others
-Source: https://github.com/codemirror/language.git
+Source: git+https://github.com/codemirror/language.git
-Link: https://github.com/codemirror/language.git
+Link: git+https://github.com/codemirror/language.git
 -----------
 @codemirror/legacy-modes
 License: MIT
@@ -3249,22 +3143,22 @@ Link: https://github.com/codemirror/legacy-modes.git
 License: MIT
 License File: node_modules/@codemirror/lint/LICENSE
 Copyright: Copyright (C) 2018-2021 by Marijn Haverbeke <******@*********.******> and others
-Source: https://github.com/codemirror/lint.git
+Source: git+https://github.com/codemirror/lint.git
-Link: https://github.com/codemirror/lint.git
+Link: git+https://github.com/codemirror/lint.git
 -----------
 @codemirror/search
 License: MIT
 License File: node_modules/@codemirror/search/LICENSE
 Copyright: Copyright (C) 2018-2021 by Marijn Haverbeke <******@*********.******> and others
-Source: https://github.com/codemirror/search.git
+Source: git+https://github.com/codemirror/search.git
-Link: https://github.com/codemirror/search.git
+Link: git+https://github.com/codemirror/search.git
 -----------
 @codemirror/state
 License: MIT
 License File: node_modules/@codemirror/state/LICENSE
 Copyright: Copyright (C) 2018-2021 by Marijn Haverbeke <******@*********.******> and others
-Source: https://github.com/codemirror/state.git
+Source: git+https://github.com/codemirror/state.git
-Link: https://github.com/codemirror/state.git
+Link: git+https://github.com/codemirror/state.git
 -----------
 @codemirror/theme-one-dark
 License: MIT
@@ -3277,8 +3171,8 @@ Link: https://github.com/codemirror/theme-one-dark.git
 License: MIT
 License File: node_modules/@codemirror/view/LICENSE
 Copyright: Copyright (C) 2018-2021 by Marijn Haverbeke <******@*********.******> and others
-Source: https://github.com/codemirror/view.git
+Source: git+https://github.com/codemirror/view.git
-Link: https://github.com/codemirror/view.git
+Link: git+https://github.com/codemirror/view.git
 -----------
 @cspotcode/source-map-support
 License: MIT
@@ -3358,12 +3252,6 @@ License File: node_modules/@eslint/core/LICENSE
 Source: git+https://github.com/eslint/rewrite.git
 Link: https://github.com/eslint/rewrite/tree/main/packages/core#readme
 -----------
-@eslint/eslintrc
-License: MIT
-License File: node_modules/@eslint/eslintrc/LICENSE
-Source: eslint/eslintrc
-Link: https://github.com/eslint/eslintrc#readme
------------
 @eslint/js
 License: MIT
 License File: node_modules/@eslint/js/LICENSE
@@ -3567,6 +3455,13 @@ Copyright: Copyright 2024 Justin Ridgewell <******@*********.****>
 Source: git+https://github.com/jridgewell/sourcemaps.git
 Link: https://github.com/jridgewell/sourcemaps/tree/main/packages/gen-mapping
 -----------
+@jridgewell/remapping
+License: MIT
+License File: node_modules/@jridgewell/remapping/LICENSE
+Copyright: Copyright 2024 Justin Ridgewell <******@*********.****>
+Source: git+https://github.com/jridgewell/sourcemaps.git
+Link: https://github.com/jridgewell/sourcemaps/tree/main/packages/remapping
+-----------
 @jridgewell/resolve-uri
 License: MIT
 License File: node_modules/@jridgewell/resolve-uri/LICENSE
@@ -3704,18 +3599,12 @@ License: MIT
 Source: git+https://github.com/un-ts/pkgr.git
 Link: https://github.com/un-ts/pkgr/blob/master/packages/core
 -----------
-@rtsao/scc
-License: MIT
-License File: node_modules/@rtsao/scc/LICENSE
-Copyright: Copyright (c) 2019 Ryan Tsao
-Source: rtsao/scc
-Link: rtsao/scc
------------
 @sinclair/typebox
 License: MIT
 License File: node_modules/@sinclair/typebox/license
-Source: https://github.com/sinclairzx81/typebox
+Copyright: Copyright (c) 2017-2026 Haydn Paterson
-Link: https://github.com/sinclairzx81/typebox
+Source: https://github.com/sinclairzx81/typebox-legacy
+Link: https://github.com/sinclairzx81/typebox-legacy
 -----------
 @sinonjs/commons
 License: BSD-3-Clause
@@ -3798,6 +3687,13 @@ Copyright: Copyright (c) Microsoft Corporation.
 Source: https://github.com/DefinitelyTyped/DefinitelyTyped.git
 Link: https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/babel__traverse
 -----------
+@types/esrecurse
+License: MIT
+License File: node_modules/@types/esrecurse/LICENSE
+Copyright: Copyright (c) Microsoft Corporation.
+Source: https://github.com/DefinitelyTyped/DefinitelyTyped.git
+Link: https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/esrecurse
+-----------
 @types/estree
 License: MIT
 License File: node_modules/@types/estree/LICENSE
@@ -3847,11 +3743,6 @@ Copyright: Copyright (c) Microsoft Corporation.
 Source: https://github.com/DefinitelyTyped/DefinitelyTyped.git
 Link: https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/json-schema
 -----------
-@types/json5
-License: MIT
-Source: https://www.github.com/DefinitelyTyped/DefinitelyTyped.git
-Link: https://www.github.com/DefinitelyTyped/DefinitelyTyped.git
------------
 @types/linkify-it
 License: MIT
 License File: node_modules/@types/linkify-it/LICENSE

dev/licensing/php-library-licenses.txt

@@ -109,7 +109,7 @@ firebase/php-jwt
 License: BSD-3-Clause
 License File: vendor/firebase/php-jwt/LICENSE
 Copyright: Copyright (c) 2011, Neuman Vong
-Source: https://github.com/firebase/php-jwt.git
+Source: https://github.com/googleapis/php-jwt.git
 Link: https://github.com/firebase/php-jwt
 -----------
 fruitcake/php-cors

lang/ar/activities.php

@@ -99,6 +99,8 @@ return [
     'user_update_notification' => 'تم تحديث المستخدم بنجاح',
     'user_delete' => 'المستخدم المحذوف',
     'user_delete_notification' => 'تم إزالة المستخدم بنجاح',
+    'user_mfa_reset' => 'reset MFA for user',
+    'user_mfa_reset_notification' => 'Multi-factor authentication methods reset',
 
     // API Tokens
     'api_token_create' => 'تم إنشاء رمز واجهة برمجة التطبيقات -API-',

lang/ar/auth.php

@@ -8,6 +8,7 @@ return [
 
     'failed' => 'البيانات المعطاة لا توافق سجلاتنا.',
     'throttle' => 'تجاوزت الحد الأقصى من المحاولات. الرجاء المحاولة مرة أخرى بعد :seconds ثانية/ثواني.',
+    'mfa_throttle' => 'Too many multi-factor verification attempts. Please try again in :seconds seconds.',
 
     // Login & Register
     'sign_up' => 'إنشاء حساب',

lang/ar/entities.php

@@ -173,6 +173,7 @@ return [
     'books_sort_desc' => 'نقل الفصول والصفحات داخل الكتاب لإعادة تنظيم محتوياته. يمكن إضافة كتب أخرى مما يسمح بنقل الفصول والصفحات بسهولة بين الكتب. اختياريًا، يمكن تعيين قاعدة فرز تلقائي لفرز محتويات هذا الكتاب تلقائيًا عند حدوث تغييرات.',
     'books_sort_auto_sort' => 'خِيار الفرز التلقائي',
     'books_sort_auto_sort_active' => 'الفرز التلقائي الشَغَّال: :sortName',
+    'books_sort_auto_sort_creation_hint' => 'Auto sort option rules can be created in the "Lists & Sorting" settings area by a user with the relevant permissions.',
     'books_sort_named' => 'فرز كتاب :bookName',
     'books_sort_name' => 'ترتيب حسب الإسم',
     'books_sort_created' => 'ترتيب حسب تاريخ الإنشاء',
@@ -330,6 +331,9 @@ return [
 
     // Editor Sidebar
     'toggle_sidebar' => 'تبديل الشريط الجانبي',
+    'page_contents' => 'Page Contents',
+    'page_contents_none' => 'No headings were found in the page content.',
+    'page_contents_info' => 'The contents menu is generated from any heading formats used in the page.',
     'page_tags' => 'وسوم الصفحة',
     'chapter_tags' => 'وسوم الفصل',
     'book_tags' => 'وسوم الكتاب',

lang/ar/settings.php

@@ -207,6 +207,7 @@ return [
     'role_all' => 'الكل',
     'role_own' => 'ما يخص',
     'role_controlled_by_asset' => 'يتحكم فيها الأصول التي يتم رفعها إلى',
+    'role_controlled_by_page_delete' => 'Controlled by page delete permissions',
     'role_save' => 'حفظ الدور',
     'role_users' => 'مستخدمون داخل هذا الدور',
     'role_users_none' => 'لم يتم تعيين أي مستخدمين لهذا الدور',
@@ -263,6 +264,9 @@ return [
     'users_mfa_desc' => 'إعداد المصادقة متعددة العوامل كطبقة إضافية من الأمان لحساب المستخدم الخاص بك.',
     'users_mfa_x_methods' => ':count طريقة مُهيأة | :count طرق مُهيأة',
     'users_mfa_configure' => 'إعداد الطرق',
+    'users_mfa_reset' => 'Reset Multi-Factor Authentication Methods',
+    'users_mfa_reset_desc' => 'This will reset and clear all configured multi-factor authentication methods for this user. If multi-factor authentication is required by any of their roles, they\'ll be prompted to configure new methods on their next login.',
+    'users_mfa_reset_confirm' => 'Are you sure you want to reset multi-factor authentication for this user?',
 
     // API Tokens
     'user_api_token_create' => 'قم بإنشاء رمز API',
@@ -363,6 +367,7 @@ return [
         'sk' => 'Slovensky',
         'sl' => 'Slovenščina',
         'sv' => 'Svenska',
+        'th' => 'ภาษาไทย',
         'tr' => 'Türkçe',
         'uk' => 'Українська',
         'uz' => 'O‘zbekcha',

lang/bg/activities.php

@@ -99,6 +99,8 @@ return [
     'user_update_notification' => 'Потребителят е обновен успешно',
     'user_delete' => 'deleted user',
     'user_delete_notification' => 'Потребителят е премахнат успешно',
+    'user_mfa_reset' => 'reset MFA for user',
+    'user_mfa_reset_notification' => 'Multi-factor authentication methods reset',
 
     // API Tokens
     'api_token_create' => 'created API token',

lang/bg/auth.php

@@ -8,6 +8,7 @@ return [
 
     'failed' => 'Въведените данни не съвпадат с информацията в системата.',
     'throttle' => 'Твърде много опити за влизане. Опитайте пак след :seconds секунди.',
+    'mfa_throttle' => 'Too many multi-factor verification attempts. Please try again in :seconds seconds.',
 
     // Login & Register
     'sign_up' => 'Регистриране',

lang/bg/entities.php

@@ -173,6 +173,7 @@ return [
     'books_sort_desc' => 'Move chapters and pages within a book to reorganise its contents. Other books can be added which allows easy moving of chapters and pages between books. Optionally an auto sort rule can be set to automatically sort this book\'s contents upon changes.',
     'books_sort_auto_sort' => 'Auto Sort Option',
     'books_sort_auto_sort_active' => 'Auto Sort Active: :sortName',
+    'books_sort_auto_sort_creation_hint' => 'Auto sort option rules can be created in the "Lists & Sorting" settings area by a user with the relevant permissions.',
     'books_sort_named' => 'Сортирай книга :bookName',
     'books_sort_name' => 'Сортиране по име',
     'books_sort_created' => 'Сортирай по дата на създаване',
@@ -330,6 +331,9 @@ return [
 
     // Editor Sidebar
     'toggle_sidebar' => 'Toggle Sidebar',
+    'page_contents' => 'Page Contents',
+    'page_contents_none' => 'No headings were found in the page content.',
+    'page_contents_info' => 'The contents menu is generated from any heading formats used in the page.',
     'page_tags' => 'Тагове на страницата',
     'chapter_tags' => 'Тагове на главата',
     'book_tags' => 'Тагове на книгата',

lang/bg/settings.php

@@ -207,6 +207,7 @@ return [
     'role_all' => 'Всички',
     'role_own' => 'Собствени',
     'role_controlled_by_asset' => 'Контролирани от актива, към който са качени',
+    'role_controlled_by_page_delete' => 'Controlled by page delete permissions',
     'role_save' => 'Запази ролята',
     'role_users' => 'Потребители в тази роля',
     'role_users_none' => 'В момента няма потребители, назначени за тази роля',
@@ -263,6 +264,9 @@ return [
     'users_mfa_desc' => 'Настрой многофакторно удостверяване като втори слой сигурност на твоя профил.',
     'users_mfa_x_methods' => ':count метод е настроен|:count методи са настроени',
     'users_mfa_configure' => 'Конфигурирай методи',
+    'users_mfa_reset' => 'Reset Multi-Factor Authentication Methods',
+    'users_mfa_reset_desc' => 'This will reset and clear all configured multi-factor authentication methods for this user. If multi-factor authentication is required by any of their roles, they\'ll be prompted to configure new methods on their next login.',
+    'users_mfa_reset_confirm' => 'Are you sure you want to reset multi-factor authentication for this user?',
 
     // API Tokens
     'user_api_token_create' => 'Създай API маркер',
@@ -363,6 +367,7 @@ return [
         'sk' => 'Slovensky',
         'sl' => 'Slovenščina',
         'sv' => 'Svenska',
+        'th' => 'ภาษาไทย',
         'tr' => 'Türkçe',
         'uk' => 'Українська',
         'uz' => 'O‘zbekcha',

lang/bn/activities.php

@@ -99,6 +99,8 @@ return [
     'user_update_notification' => 'ব্যবহারকারীটি সার্থকভাবে হালনাগাদ করা হয়েছে',
     'user_delete' => 'ব্যবহারকারীটি মুছে ফেলেছেন',
     'user_delete_notification' => 'ব্যবহারকারীটি সার্থকভাবে মুছে ফেলা হয়েছে',
+    'user_mfa_reset' => 'reset MFA for user',
+    'user_mfa_reset_notification' => 'Multi-factor authentication methods reset',
 
     // API Tokens
     'api_token_create' => 'এপিআই টোকেনটি তৈরী করেছেন',

lang/bn/auth.php

@@ -8,6 +8,7 @@ return [
 
     'failed' => 'প্রদত্ত তথ্যনিরূপিত কোন রেকর্ড পাওয়া যায়নি।',
     'throttle' => 'লগইন প্রচেষ্টার সীমা অতিক্রান্ত। দয়া করে :seconds সেকেন্ড পর আবার চেষ্টা করুন।',
+    'mfa_throttle' => 'Too many multi-factor verification attempts. Please try again in :seconds seconds.',
 
     // Login & Register
     'sign_up' => 'নিবন্ধিত হোন',

lang/bn/entities.php

@@ -173,6 +173,7 @@ return [
     'books_sort_desc' => 'Move chapters and pages within a book to reorganise its contents. Other books can be added which allows easy moving of chapters and pages between books. Optionally an auto sort rule can be set to automatically sort this book\'s contents upon changes.',
     'books_sort_auto_sort' => 'Auto Sort Option',
     'books_sort_auto_sort_active' => 'Auto Sort Active: :sortName',
+    'books_sort_auto_sort_creation_hint' => 'Auto sort option rules can be created in the "Lists & Sorting" settings area by a user with the relevant permissions.',
     'books_sort_named' => 'Sort Book :bookName',
     'books_sort_name' => 'Sort by Name',
     'books_sort_created' => 'Sort by Created Date',
@@ -330,6 +331,9 @@ return [
 
     // Editor Sidebar
     'toggle_sidebar' => 'Toggle Sidebar',
+    'page_contents' => 'Page Contents',
+    'page_contents_none' => 'No headings were found in the page content.',
+    'page_contents_info' => 'The contents menu is generated from any heading formats used in the page.',
     'page_tags' => 'Page Tags',
     'chapter_tags' => 'Chapter Tags',
     'book_tags' => 'Book Tags',

lang/bn/settings.php

@@ -207,6 +207,7 @@ return [
     'role_all' => 'All',
     'role_own' => 'Own',
     'role_controlled_by_asset' => 'Controlled by the asset they are uploaded to',
+    'role_controlled_by_page_delete' => 'Controlled by page delete permissions',
     'role_save' => 'Save Role',
     'role_users' => 'Users in this role',
     'role_users_none' => 'No users are currently assigned to this role',
@@ -263,6 +264,9 @@ return [
     'users_mfa_desc' => 'Setup multi-factor authentication as an extra layer of security for your user account.',
     'users_mfa_x_methods' => ':count method configured|:count methods configured',
     'users_mfa_configure' => 'Configure Methods',
+    'users_mfa_reset' => 'Reset Multi-Factor Authentication Methods',
+    'users_mfa_reset_desc' => 'This will reset and clear all configured multi-factor authentication methods for this user. If multi-factor authentication is required by any of their roles, they\'ll be prompted to configure new methods on their next login.',
+    'users_mfa_reset_confirm' => 'Are you sure you want to reset multi-factor authentication for this user?',
 
     // API Tokens
     'user_api_token_create' => 'Create API Token',
@@ -363,6 +367,7 @@ return [
         'sk' => 'Slovensky',
         'sl' => 'Slovenščina',
         'sv' => 'Svenska',
+        'th' => 'ภาษาไทย',
         'tr' => 'Türkçe',
         'uk' => 'Українська',
         'uz' => 'O‘zbekcha',