bvandeusenandClaude Sonnet 4.6 00643c778e security: fix 10 vulnerabilities from security audit ...

- SSRF: block private/internal URLs in image cache fetch
- SSRF: block private/internal URLs in RSS feed fetch (scheme guard)
- SSRF: block private/internal URLs in CalDAV URL setting
- Auth: require login for GET /api/images/<id> (was unauthenticated)
- Auth: restrict Ollama model pull/delete to admin users only
- Info disclosure: remove email from /api/users/search response
- OAuth: skip email-based account linking when email_verified is false
- Config: raise hard error on default SECRET_KEY when SECURE_COOKIES=true
- Rate limit: document proxy header requirement; add startup warning
- XSS: remove src/alt from global DOMPurify ADD_ATTR allowlist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-29 00:37:13 -04:00

..

__init__.py

Initial commit: note-taking/task-tracking app with LLM integration scaffold

2026-02-09 23:35:44 -05:00

admin.py

Add invitation system, table of contents, actionable dashboard, and settings improvements

2026-02-14 08:46:51 -05:00

api_keys.py

feat: API key routes, search endpoint, conversation type wiring

2026-03-23 21:01:04 -04:00

api.py

Add CalVer build-time version tracking

2026-03-11 16:10:57 -04:00

auth.py

security: fix 10 vulnerabilities from security audit

2026-03-29 00:37:13 -04:00

briefing.py

security: fix 10 vulnerabilities from security audit

2026-03-29 00:37:13 -04:00

chat.py

security: fix 10 vulnerabilities from security audit

2026-03-29 00:37:13 -04:00

events.py

fix(events): use g.user.id instead of g.user_id in route helper

2026-03-25 14:12:12 -04:00

export.py

UI polish pass: word count, slash commands, task lists, graph peek, bulk delete, export

2026-03-07 23:15:01 -05:00

fable_mcp_dist.py

feat(fable-mcp): build wheel in Docker image, serve download, add admin log tool, and Settings install UI

2026-03-24 17:26:05 -04:00

groups.py

Multi-user sharing, groups, and in-app notifications

2026-03-11 15:37:00 -04:00

images.py

security: fix 10 vulnerabilities from security audit

2026-03-29 00:37:13 -04:00

in_app_notifications.py

Multi-user sharing, groups, and in-app notifications

2026-03-11 15:37:00 -04:00

milestones.py

refactor: DRY pass on backend — pagination helper and sharing utilities

2026-03-26 22:52:39 -04:00

notes.py

feat: support multi-value status and priority filters in list_notes

2026-03-27 23:01:24 -04:00

projects.py

refactor: DRY pass on backend — pagination helper and sharing utilities

2026-03-26 22:52:39 -04:00

push.py

Add Projects, Milestones, RAG auto-inject, push notifications, PWA, tag normalisation

2026-03-02 20:52:21 -05:00

quick_capture.py

feat: kanban status buttons, task back-nav, RSS UI, weather search, briefing fixes

2026-03-24 00:42:01 -04:00

search.py

feat: API key routes, search endpoint, conversation type wiring

2026-03-23 21:01:04 -04:00

settings.py

security: fix 10 vulnerabilities from security audit

2026-03-29 00:37:13 -04:00

shares.py

Multi-user sharing, groups, and in-app notifications

2026-03-11 15:37:00 -04:00

task_logs.py

Fix ruff E741: rename ambiguous variable l → log in task_logs route

2026-03-09 22:28:34 -04:00

tasks.py

feat: add recurrence_rule validation and recurrence-preview endpoint in tasks routes

2026-03-27 22:54:11 -04:00

users.py

security: fix 10 vulnerabilities from security audit

2026-03-29 00:37:13 -04:00

utils.py

refactor: DRY pass on backend — pagination helper and sharing utilities

2026-03-26 22:52:39 -04:00