bvandeusenandClaude Opus 5.5
6028d78844
release / govulncheck (push) Successful in 17s
release / web (push) Successful in 1m33s
release / go (push) Successful in 1m49s
release / integration (push) Successful in 5m42s
release / android (push) Successful in 5m59s
release / Build signed APK (releases and dev) (push) Successful in 6m9s
release / Attach APK to the Release (tag releases only) (push) Skipped
release / Build + push container image (push) Successful in 16s
release / Verify release artifacts (tag releases only) (push) Skipped
Applies rule 32's migration exception: each header still says what the schema was, what changes and what it prevents, but task, milestone, decision and rule ids are replaced by the practice they stood for, the operator quotes by the decision, single-install counts are dropped, and pointers to a deleted package and an external design doc are gone. golang-migrate keeps no checksum, so editing applied migrations' comments is safe. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
9 lines
484 B
SQL
9 lines
484 B
SQL
-- The address users reach Minstrel at, e.g. https://music.example.com.
|
|
--
|
|
-- Before: password-reset links were built from the request's Host header,
|
|
-- which the requester controls, so a forgot-password call with a forged Host
|
|
-- would email the victim a real reset token on a link to the attacker's
|
|
-- server. After: links are built only from this admin-set value, and none
|
|
-- are sent while it is empty.
|
|
ALTER TABLE network_settings ADD COLUMN public_url text NOT NULL DEFAULT '';
|