Dan Brown 81f77a95de Content Filtering: Limited file protocol to just anchor hrefs ...

Updated allow list/purifier system to only allow file protocol use on
anchor hrefs to avoid potential security concerns with, after export,
content being auto loaded via interactive elements like
embeds/objects/videos etc...

Updated tests to cover.
Thanks to Gurmandeep Deol at Seneca Polytechnic for reporting.

2026-06-06 15:30:57 +01:00

..

Activity

Testing: Changed ordering in tests to help prevent flaky test

2026-05-19 13:29:26 +01:00

Api

Images: Increased validation against related page on upload

2026-05-14 18:10:46 +01:00

Auth

MFA: Added verify attempt rate limiting

2026-05-21 13:25:57 +01:00

Commands

Images: Increased validation against related page on upload

2026-05-14 18:10:46 +01:00

Entity

Content Filtering: Limited file protocol to just anchor hrefs

2026-06-06 15:30:57 +01:00

Exports

Exports: Added testing coverage for DOMPDF font usage

2026-04-22 13:12:34 +01:00

Helpers

Images: Increased validation against related page on upload

2026-05-14 18:10:46 +01:00

Meta

DB: Aligned entity structure to a common table

2025-10-18 13:14:30 +01:00

Permissions

Images: Increased validation against related page on upload

2026-05-14 18:10:46 +01:00

References

DB: Aligned entity structure to a common table

2025-10-18 13:14:30 +01:00

Search

Search: Prevented tag search using unusable numbers

2026-06-06 10:37:06 +01:00

Settings

Deps: Updated PHP package versions

2025-12-19 14:22:27 +00:00

Sorting

Sort Rules: Added creation hints to sort rule selection

2026-04-12 14:31:40 +01:00

test-data

Exports: Added testing coverage for DOMPDF font usage

2026-04-22 13:12:34 +01:00

Theme

Theme Modules: Added easier way to insert HTML head content

2026-03-08 10:26:00 +00:00

Unit

SSR: Hardened URL validator against a range of workarounds

2026-04-30 10:18:50 +01:00

Uploads

Images: Increased validation against related page on upload

2026-05-14 18:10:46 +01:00

User

User MFA: Reviewed addition of reset, added tests

2026-05-17 13:05:50 +01:00

Util

Merge pull request 'Merge v26.03 branch changes' (#6122) from v26-03 into development

2026-05-14 16:08:26 +02:00

CreatesApplication.php

Framework: Upgrade from Laravel 9 to 10

2024-03-16 15:12:14 +00:00

DebugViewTest.php

Meta: Updated security info and fixed some tests/links

2026-04-30 00:32:27 +01:00

ErrorTest.php

Images: Increased validation against related page on upload

2026-05-14 18:10:46 +01:00

FavouriteTest.php

URL Handling: Removed referrer-based redirect handling

2023-12-10 12:37:21 +00:00

HomepageTest.php

Homepage: Added tags button to non-default home views

2023-09-24 09:31:44 +01:00

LanguageTest.php

Search Index: Fixed SQL error when indexing large pages

2024-12-11 15:55:19 +00:00

PublicActionTest.php

Images: Increased validation against related page on upload

2026-05-14 18:10:46 +01:00

SecurityHeaderTest.php

CSP: Renamed CSS CSP option

2026-05-26 12:50:19 +01:00

SessionTest.php

Sessions: Ignored extra meta/dist content in history tracking

2025-12-03 14:10:09 +00:00

StatusTest.php

Added testing for webhook management interface

2021-12-10 14:54:58 +00:00

TestCase.php

Theme System: Split & organised tests, changed module version to string

2026-02-01 16:27:52 +00:00

UrlTest.php

Mail: Removed custom symfony/mailer fork

2025-07-15 15:24:31 +01:00