Linus Rath 0fcdc2ece4 fix: reach a company calendar on a private address only when its host names the intranet

2026-11-01 06:35:56 +01:00

..

app-frame-origins-client.ts

fix: keep sibling subdomains from widening the sidebar-app frame-src

2026-09-26 16:27:03 +02:00

app-frame-origins.ts

fix: keep sibling subdomains from widening the sidebar-app frame-src

2026-09-26 16:27:03 +02:00

capped-body.ts

fix: stop buffering up to 100 MB of every unauthenticated request body before routing

2026-10-26 14:52:04 +01:00

ip-ranges.ts

fix: block loopback, CGNAT and IPv6 transition ranges in the SSRF guard

2026-09-26 14:00:01 +02:00

request-protocol.ts

fix: stop trusting the unprefixed sidebar-app frame cookie when COOKIE_SECURE=true (GHSA-cjm9-m826-mh78)

2026-10-26 11:48:38 +01:00

same-origin.ts

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00

url-guard.ts

fix: reach a company calendar on a private address only when its host names the intranet

2026-11-01 06:35:56 +01:00