Matthew Meszaros 9bb0a39e96 feat: answer a repeated single-valued query parameter with 400 duplicate_query_parameter and a repeated Authorization, X-Warmbly-Token, Idempotency-Key or Origin header with 400 duplicate_header on the API and forms service, keep the documented list parameters repeatable, fold X-Forwarded-For lines and read the last line of the other forwarding headers there and in the tracking service

2026-10-23 16:03:06 +02:00

..

handler

feat: check every mailbox SMTP and IMAP dial against its resolved peer address in netbind, refusing loopback, private, link-local, CGNAT, multicast and metadata addresses on hosted production and wherever MAIL_ALLOW_PRIVATE_HOSTS=false, render that resolved policy into each joining node's env, and honour WARMBLY_ALLOW_UNSAFE_WEBHOOK_URLS only on self-hosted or development instances

2026-10-23 16:02:52 +02:00

middleware

feat: answer a repeated single-valued query parameter with 400 duplicate_query_parameter and a repeated Authorization, X-Warmbly-Token, Idempotency-Key or Origin header with 400 duplicate_header on the API and forms service, keep the documented list parameters repeatable, fold X-Forwarded-For lines and read the last line of the other forwarding headers there and in the tracking service

2026-10-23 16:03:06 +02:00

cors.go

feat: move infrastructure state off dynamodb

2026-06-02 15:54:12 +02:00

resource_scope_routes_test.go

feat: answer a repeated single-valued query parameter with 400 duplicate_query_parameter and a repeated Authorization, X-Warmbly-Token, Idempotency-Key or Origin header with 400 duplicate_header on the API and forms service, keep the documented list parameters repeatable, fold X-Forwarded-For lines and read the last line of the other forwarding headers there and in the tracking service

2026-10-23 16:03:06 +02:00

routes.go

feat: answer a repeated single-valued query parameter with 400 duplicate_query_parameter and a repeated Authorization, X-Warmbly-Token, Idempotency-Key or Origin header with 400 duplicate_header on the API and forms service, keep the documented list parameters repeatable, fold X-Forwarded-For lines and read the last line of the other forwarding headers there and in the tracking service

2026-10-23 16:03:06 +02:00

upload_limit_test.go

feat: let contact file uploads use their own 50 MB cap instead of the global 10 MB one and say when a file is too large, refuse an import list limit below one, hold an imported update to the contact size limit, keep a company logo laid out while it lazy-loads, neutralize formula cells in the sync error download, settle the draft save indicator when an edit is undone, and document the draft save route

2026-09-27 22:10:02 -07:00