Kolega.devandkolega.dev 7ae6635d16 fix: validate loginRedirect cookie to prevent open redirect (#7923) ...

The loginRedirect cookie value was used directly in res.redirect() and
window.location.replace() without validation, allowing redirection to
arbitrary external URLs. Added validation to ensure the redirect target
is a relative path before use.

Co-authored-by: kolega.dev <faizan@kolega.ai>

2026-02-11 21:27:36 -05:00

..

app

fix: set securityTrustProxy to false by default

2024-01-28 20:03:06 -05:00

controllers

fix: validate loginRedirect cookie to prevent open redirect (#7923)

2026-02-11 21:27:36 -05:00

core

fix: add cookie secure flag when site is using https

2026-01-08 04:22:22 -05:00

db

fix: force lowercase for email on local auth

2020-09-09 19:59:46 -04:00

graph

refactor: update docker images to Node 24 and fix promisify calls

2026-01-03 03:03:15 -05:00

helpers

fix: add cookie secure flag when site is using https

2026-01-08 04:22:22 -05:00

jobs

fix: sanitize SVG uploads

2021-12-17 21:41:38 -05:00

locales

feat: load dev locale files

2019-02-09 12:34:27 -05:00

middlewares

fix: remove unused middleware

2021-09-11 21:02:53 -04:00

models

fix: add cookie secure flag when site is using https

2026-01-08 04:22:22 -05:00

modules

feat: map OIDC/OAuth2 avatar claims to user pictureUrl (#7908)

2026-01-23 18:36:52 -05:00

templates

feat: password reset

2020-08-30 21:46:55 -04:00

test/helpers

refactor: server code (#2545)

2020-10-14 11:16:27 -04:00

themes/default

feat: admin edit user (wip)

2019-08-11 23:26:29 -04:00

views

fix: disable template compilation in source view

2023-06-03 23:15:22 -04:00

index.js

fix: remove upper range node.js version check

2024-04-24 20:46:11 -04:00

master.js

fix: handle empty ToC position value

2023-02-16 23:58:52 -05:00

setup.js

refactor: update docker images to Node 24 and fix promisify calls

2026-01-03 03:03:15 -05:00