bvandeusenandClaude Sonnet 4.6 00643c778e security: fix 10 vulnerabilities from security audit ...

- SSRF: block private/internal URLs in image cache fetch
- SSRF: block private/internal URLs in RSS feed fetch (scheme guard)
- SSRF: block private/internal URLs in CalDAV URL setting
- Auth: require login for GET /api/images/<id> (was unauthenticated)
- Auth: restrict Ollama model pull/delete to admin users only
- Info disclosure: remove email from /api/users/search response
- OAuth: skip email-based account linking when email_verified is false
- Config: raise hard error on default SECRET_KEY when SECURE_COOKIES=true
- Rate limit: document proxy header requirement; add startup warning
- XSS: remove src/alt from global DOMPurify ADD_ATTR allowlist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-29 00:37:13 -04:00

..

BriefingView.vue

fix: pass temp_unit from API to WeatherCard so F/C label matches converted values

2026-03-28 13:21:30 -04:00

CalendarView.vue

feat(calendar): internal event store with FullCalendar UI and CalDAV push sync

2026-03-25 13:38:09 -04:00

ChatView.vue

feat(rag): RAG scoping and context isolation controls

2026-03-25 17:44:39 -04:00

ForgotPasswordView.vue

Add email-based password reset flow

2026-02-13 21:42:45 -05:00

GraphView.vue

UI polish: hover lift, skeleton loaders, empty states, badge contrast, transitions

2026-03-10 18:34:52 -04:00

HomeView.vue

refactor: DRY pass on frontend — shared palette, composable, and tab loader

2026-03-26 22:43:59 -04:00

LoginView.vue

Add Authentik OAuth/OIDC SSO, email change, and setup docs

2026-02-25 20:12:13 -05:00

LogsView.vue

Show IP address in audit log table and expanded detail row

2026-02-22 21:30:08 -05:00

NewsView.vue

feat: add /news archive view with feed filter and pagination

2026-03-28 00:51:24 -04:00

NoteEditorView.vue

Move history to sidebar, simplify task assist, add content deduplication

2026-03-11 16:56:30 -04:00

NotesListView.vue

UI polish: notes/tasks list views

2026-03-10 22:39:05 -04:00

NoteViewerView.vue

Multi-user sharing, groups, and in-app notifications

2026-03-11 15:37:00 -04:00

ProjectListView.vue

refactor: DRY pass on frontend — shared palette, composable, and tab loader

2026-03-26 22:43:59 -04:00

ProjectView.vue

feat: kanban status buttons, task back-nav, RSS UI, weather search, briefing fixes

2026-03-24 00:42:01 -04:00

RegisterInviteView.vue

Add invitation system, table of contents, actionable dashboard, and settings improvements

2026-02-14 08:46:51 -05:00

RegisterView.vue

Add registration control, admin user management, and security hardening

2026-02-12 17:49:22 -05:00

ResetPasswordView.vue

Add email-based password reset flow

2026-02-13 21:42:45 -05:00

SettingsView.vue

security: fix 10 vulnerabilities from security audit

2026-03-29 00:37:13 -04:00

SharedWithMeView.vue

Multi-user sharing, groups, and in-app notifications

2026-03-11 15:37:00 -04:00

TaskEditorView.vue

feat: task management enhancements (cancelled status, recurrence, timestamps)

2026-03-28 00:51:36 -04:00

TasksListView.vue

feat: task management enhancements (cancelled status, recurrence, timestamps)

2026-03-28 00:51:36 -04:00

TaskViewerView.vue

feat: task management enhancements (cancelled status, recurrence, timestamps)

2026-03-28 00:51:36 -04:00

UserManagementView.vue

Redesign writing assistant UI: right-side panel, diff view, proofread, floating inline assist

2026-02-19 16:43:41 -05:00

WorkspaceView.vue

fix: auto-scroll workspace chat when messages are added

2026-03-12 18:02:28 -04:00