kolaente 154a96674d fix(notifications): strip remote images from notification emails ... User-controlled fields rendered into notification emails (task title via the conversational header, comment and description bodies) were sanitized with a bluemonday UGCPolicy that permits remote <img> sources. An attacker with write access to a shared project could therefore inject an external image that acts as a tracking pixel in a subscriber's inbox, leaking email-open time and IP. Restrict notification-email images to inline data URIs (used by avatars) by adding a RewriteSrc hook that blanks any non-data image src. The policy was duplicated in three places, so extract it into newNotificationSanitizer. Refs GHSA-2vr2-r3qw-rjvq		2026-06-11 06:53:37 +00:00
..
caldav	fix(caldav): escape user-controlled strings per RFC 5545 in VCALENDAR output	2026-04-09 15:44:04 +00:00
caldavtests	fix(caldav): skip tests for known CalDAV bugs and fix timing issues	2026-04-02 11:34:55 +00:00
cmd	fix(cli): guard last admin on scheduled CLI deletion path	2026-04-20 18:55:06 +00:00
config	feat: always enable bot users	2026-05-04 10:38:53 +00:00
cron	fix: correct license header references (#882)	2025-06-10 12:18:38 +02:00
db	feat(api/v2): add user webhooks on /api/v2	2026-06-10 19:12:41 +00:00
doctor	feat(auth): enforce OpenID Connect issuer uniqueness across providers	2026-03-30 22:41:50 +00:00
e2etests	test(webhook): assert bad webhook is retried in no-duplicate test	2026-04-09 09:26:04 +00:00
events	feat: add InitEventsForTesting and Unfake for real event dispatch in tests	2026-03-05 12:49:27 +01:00
files	docs(api/v2): tag task attachment fields for the v2 schema	2026-06-10 10:22:39 +00:00
health	feat: introduce shared health check logic (#1073)	2025-07-02 21:01:41 +00:00
i18n	chore(i18n): update translations via Crowdin	2026-05-27 02:31:52 +00:00
initialize	refactor(user): remove the now-empty listeners file	2026-05-30 13:48:01 +00:00
license	fix(license): degrade to free when servers unreachable or key rejected	2026-04-20 18:55:06 +00:00
log	fix(mail): guard log calls in GetMailDomain and fix hostname-dependent tests	2026-04-03 18:30:39 +00:00
mail	feat: add Atom feed for user notifications with API token auth (#2758)	2026-05-15 17:25:09 +02:00
metrics	refactor(metrics): count entities on demand with a TTL cache	2026-05-30 13:48:01 +00:00
migration	feat(time-tracking): add the time_entries table migration	2026-06-08 13:54:09 +00:00
models	feat(api/v2): add user webhooks on /api/v2	2026-06-10 19:12:41 +00:00
modules	fix(api/v2): reject non-decodable images (e.g. SVG) on avatar upload with 400	2026-06-02 11:55:25 +00:00
notifications	fix(notifications): strip remote images from notification emails	2026-06-11 06:53:37 +00:00
plugins	test(plugins): add yaegi plugin integration tests	2026-03-30 20:44:46 +00:00
red	fix: correct license header references (#882)	2025-06-10 12:18:38 +02:00
routes	feat(api/v2): add user account-deletion flow on /api/v2	2026-06-10 19:15:05 +00:00
swagger	[skip ci] Updated swagger docs	2026-06-09 23:32:10 +00:00
user	docs(api/v2): tag TOTP fields for the v2 schema	2026-06-10 17:58:16 +00:00
utils	fix: add timeouts to Gravatar, Unsplash, and SSRF-safe HTTP clients	2026-04-09 07:31:08 +00:00
version	fix: correct license header references (#882)	2025-06-10 12:18:38 +02:00
web	refactor(task-attachment): share upload+download via pkg/web/files for v1+v2	2026-06-10 10:22:39 +00:00
websocket	feat(time-tracking): let clients subscribe to timer events	2026-06-08 13:54:09 +00:00
webtests	feat(api/v2): add user account-deletion flow on /api/v2	2026-06-10 19:15:05 +00:00
yaegi_symbols	refactor(user): remove the now-empty listeners file	2026-05-30 13:48:01 +00:00