IntenseFinance/firefly-iii
3
0
Fork 0
mirror of https://github.com/firefly-iii/firefly-iii.git synced 2026-08-17 16:35:20 -05:00
Code Issues Packages Projects Releases Wiki Activity
23,158 Commits 9 Branches 1,136 Tags
3d64f7fe08c42a6f4d5efa454e484af202d07613
Commit Graph
23158 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
JC5 3d64f7fe08 🤖 Auto commit for release 'develop' on 2026-05-20 2026-05-20 20:38:20 +02:00
James Cole f2efb69b76 Fix broken if statement 2026-05-20 20:30:30 +02:00
James Cole 7499a414f4 Expand changelog 2026-05-20 20:24:50 +02:00
James Cole 8b0f790a56 Merge branch 'main' into develop 2026-05-20 20:18:10 +02:00
James Cole b70ed32952 Merge pull request #12271 from alanturing881/fix/stored-xss-ale-piggy-name 
Fix stored XSS in audit log view via piggy bank name (ale.twig)
 2026-05-20 20:16:16 +02:00
James Cole 9e511c822e Update pr-reply-no-disclosure.yml 
Signed-off-by: James Cole <james@firefly-iii.org>
 2026-05-20 20:12:40 +02:00
iaohkutandClaude Sonnet 4.6 fa6c123595 Fix stored XSS in ALE view by HTML-escaping piggy bank name 
The Twig template ale.twig rendered the piggy bank name from
AuditLogEntry.after.piggy using |raw, bypassing auto-escaping.
A user-controlled name containing HTML (e.g. <img onerror=...>)
would execute as JavaScript in any browser viewing the transaction
audit log (CWE-79).

Apply |e filter to escape only the user-controlled `name` parameter
before substitution into the trans() string. The |raw filter is
preserved because the `amount` parameter legitimately contains
<span> tags for currency styling.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-20 11:07:57 -04:00
James Cole ec1dfca2b5 Enhance PR workflow to check for author 
Added logic to check for the author of the pull request.

Signed-off-by: James Cole <james@firefly-iii.org>
 2026-05-19 08:15:40 +02:00
James Cole bebd3b189e Merge pull request #12265 from firefly-iii/dependabot/npm_and_yarn/develop/vite-8.0.13 
Bump vite from 8.0.11 to 8.0.13
 2026-05-18 08:11:34 +02:00
github-actions[bot] e3319dca5d Merge pull request #12266 from firefly-iii/release-1779078811 
🤖 Automatically merge the PR into the develop branch.
develop-20260518 		2026-05-18 06:33:40 +02:00
JC5 a38cb85f55 🤖 Auto commit for release 'develop' on 2026-05-18 2026-05-18 06:33:31 +02:00
dependabot[bot] 0226673a01 Bump vite from 8.0.11 to 8.0.13 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.11 to 8.0.13.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.13/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.0.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-18 04:27:29 +00:00
github-actions[bot] 7816f1be9b Merge pull request #12263 from firefly-iii/release-1779030686 
🤖 Automatically merge the PR into the develop branch.
develop-20260517.1 		2026-05-17 17:11:33 +02:00
JC5 5878173e80 🤖 Auto commit for release 'develop' on 2026-05-17 2026-05-17 17:11:26 +02:00
github-actions[bot] 45c30f11bc Merge pull request #12260 from firefly-iii/release-1778986654 
🤖 Automatically merge the PR into the develop branch.
develop-20260517 		2026-05-17 04:57:40 +02:00
JC5 fea97efdbf 🤖 Auto commit for release 'develop' on 2026-05-17 2026-05-17 04:57:34 +02:00
James Cole fe0e8796ca Merge branch 'main' into develop 2026-05-17 04:50:57 +02:00
James Cole e83c5b9f86 New workflow. 2026-05-17 04:50:34 +02:00
James Cole 9558f05947 Merge branch 'main' into develop 2026-05-17 04:29:39 +02:00
James Cole f3d6bb0fb5 Possible fix for https://github.com/firefly-iii/firefly-iii/issues/12258 2026-05-17 04:28:06 +02:00
James Cole 57010cd2e0 Fix https://github.com/firefly-iii/firefly-iii/issues/12257 2026-05-17 04:26:45 +02:00
James Cole 9436eeacaf Update warning about AI-generated security advisories 
Clarified consequences of reporting AI-generated security advisories.

Signed-off-by: James Cole <james@firefly-iii.org>
 2026-05-17 03:44:01 +02:00
github-actions[bot] 7ddf395ea9 Merge pull request #12256 from firefly-iii/release-1778958406 
🤖 Automatically merge the PR into the develop branch.
develop-20260516.1 		2026-05-16 21:06:52 +02:00
JC5 492c55bd76 🤖 Auto commit for release 'develop' on 2026-05-16 2026-05-16 21:06:46 +02:00
James Cole 894dea5c9c Fix https://github.com/firefly-iii/firefly-iii/issues/12254 as suggested by @imjuzcy 2026-05-16 21:01:50 +02:00
github-actions[bot] fecf12790d Merge pull request #12255 from firefly-iii/release-1778957079 
🤖 Automatically merge the PR into the develop branch.
develop-20260516 		2026-05-16 20:44:49 +02:00
JC5 883c083860 🤖 Auto commit for release 'develop' on 2026-05-16 2026-05-16 20:44:39 +02:00
James Cole e059753c43 Merge branch 'main' into develop 2026-05-16 20:39:12 +02:00
James Cole 0bac0aaaee Add some debug logging. 2026-05-16 20:38:50 +02:00
James Cole 2a68c48e2a Update security reporting guidelines in security.md 
Clarified instructions for reporting false security issues.

Signed-off-by: James Cole <james@firefly-iii.org>
 2026-05-16 20:05:44 +02:00
James Cole c394034876 Clarify AI hallucinations in security reporting 
Reworded the third point to clarify AI hallucinations in security issues.

Signed-off-by: James Cole <james@firefly-iii.org>
 2026-05-16 20:05:20 +02:00
James Cole 7bd91048ea Update security.md with reporting guidelines 
Clarified reporting guidelines for security issues to prevent false reports.

Signed-off-by: James Cole <james@firefly-iii.org>
 2026-05-16 20:03:49 +02:00
James Cole d64bca7700 Merge branch 'main' into develop 2026-05-16 19:54:22 +02:00
James Cole 7d768cfa23 Add AI-generated security advisories section 
Added a section regarding AI-generated security advisories to clarify reporting policies and potential consequences.

Signed-off-by: James Cole <james@firefly-iii.org>
 2026-05-16 19:52:56 +02:00
James Cole fd50fbf193 Merge branch 'main' into develop 2026-05-12 18:48:04 +02:00
James Cole 134c232f45 Merge branch 'develop' of github.com:firefly-iii/firefly-iii into develop 2026-05-12 18:47:48 +02:00
James Cole ce603f50d8 Fix https://github.com/firefly-iii/firefly-iii/issues/12243 2026-05-12 18:45:33 +02:00
github-actions[bot] 3b7bff4c57 Merge pull request #12240 from firefly-iii/release-1778473850 
🤖 Automatically merge the PR into the develop branch.
develop-20260511 		2026-05-11 06:30:59 +02:00
JC5 1485f99579 🤖 Auto commit for release 'develop' on 2026-05-11 2026-05-11 06:30:51 +02:00
James Cole 7d24783c49 Merge pull request #12238 from firefly-iii/dependabot/npm_and_yarn/develop/vite-8.0.11 
Bump vite from 8.0.10 to 8.0.11
 2026-05-11 06:09:04 +02:00
James Cole c4ee3598e1 Merge pull request #12239 from firefly-iii/dependabot/github_actions/actions/dependency-review-action-5 
Bump actions/dependency-review-action from 4 to 5
 2026-05-11 06:08:49 +02:00
dependabot[bot] 8cf8e91448 Bump actions/dependency-review-action from 4 to 5 
Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4 to 5.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](https://github.com/actions/dependency-review-action/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-11 03:56:03 +00:00
dependabot[bot] 28f2de0df7 Bump vite from 8.0.10 to 8.0.11 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.10 to 8.0.11.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.11/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.0.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-11 03:54:53 +00:00
github-actions[bot] 86adf11263 Merge pull request #12229 from firefly-iii/release-1778308665 
🤖 Automatically merge the PR into the develop branch.
develop-20260509.1 		2026-05-09 08:37:52 +02:00
JC5 045f875041 🤖 Auto commit for release 'develop' on 2026-05-09 2026-05-09 08:37:45 +02:00
James Cole f781e9f2b6 Merge branch 'develop' of github.com:firefly-iii/firefly-iii into develop 
# Conflicts:
#	package-lock.json
 2026-05-09 08:32:43 +02:00
James Cole 5eb52812f0 Merge branch 'main' into develop 
# Conflicts:
#	package-lock.json
 2026-05-09 08:32:08 +02:00
James Cole 916abd8464 Merge pull request #12228 from firefly-iii/dependabot/npm_and_yarn/npm_and_yarn-3d438dea79 
Bump @babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.4 in the npm_and_yarn group across 1 directory
 2026-05-09 08:27:14 +02:00
dependabot[bot] 6baca9510f Bump @babel/plugin-transform-modules-systemjs 
Bumps the npm_and_yarn group with 1 update in the / directory: [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs).


Updates `@babel/plugin-transform-modules-systemjs` from 7.29.0 to 7.29.4
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs)

---
updated-dependencies:
- dependency-name: "@babel/plugin-transform-modules-systemjs"
  dependency-version: 7.29.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-09 05:54:10 +00:00
github-actions[bot] 5c22a40849 Merge pull request #12227 from firefly-iii/release-1778303410 
🤖 Automatically merge the PR into the develop branch.
develop-20260509 		2026-05-09 07:10:19 +02:00