IntenseWebs/wiki
3
0
Fork 0
mirror of https://github.com/requarks/wiki.git synced 2026-08-19 01:04:45 -05:00
Code Issues Packages Projects Releases Wiki Activity
2,189 Commits 4 Branches 129 Tags
v2.5.312
Commit Graph
2 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Kolega.devandkolega.dev d14b0a5509 fix: authenticate GraphQL subscription WebSocket connections (#7922) 
The onConnect handler for GraphQL subscriptions was empty, allowing any
client to establish a WebSocket connection and subscribe to loggingLiveTrail
without authentication. Added JWT verification in onConnect using the same
RS256 credentials and permission checks (manage:system) used elsewhere.

Co-authored-by: kolega.dev <faizan@kolega.ai>
 2026-02-11 21:40:25 -05:00
Kolega.devandkolega.dev 7ae6635d16 fix: validate loginRedirect cookie to prevent open redirect (#7923) 
The loginRedirect cookie value was used directly in res.redirect() and
window.location.replace() without validation, allowing redirection to
arbitrary external URLs. Added validation to ensure the redirect target
is a relative path before use.

Co-authored-by: kolega.dev <faizan@kolega.ai>
 2026-02-11 21:27:36 -05:00