Vinoth Kannan a747724cb6

SECURITY: limit the number of characters in watched word replacements. ...

The watch words controller creation function, create_or_update_word(), doesn’t validate the size of the replacement parameter, unlike the word parameter, when creating a replace watched word. So anyone with moderator privileges can create watched words with almost unlimited characters.

2024-07-15 19:26:06 +08:00

..

fabricators

DEV: Automatically update groups for test users with explicit TL (#25415)

2024-01-29 17:52:02 +08:00

fixtures

DEV: Improve site setting rename generator (#25354)

2024-01-25 10:45:46 +10:00

generator

DEV: Improve site setting rename generator (#25354)

2024-01-25 10:45:46 +10:00

helpers

FEATURE: Add support for custom site name in Open Graph metadata (#25373)

2024-01-22 13:57:52 -04:00

import_export

DEV: Allow fab! without block (#24314)

2023-11-09 16:47:59 -06:00

initializers

DEV: Allow fab! without block (#24314)

2023-11-09 16:47:59 -06:00

integration

DEV: Automatically update groups for test users with explicit TL (#25415)

2024-01-29 17:52:02 +08:00

integrity

Enable Embroider/Webpack code spliting for Wizard (#24919)

2023-12-20 13:15:06 +00:00

jobs

FIX: export csv file failed message (#25443)

2024-01-26 11:16:02 -07:00

lib

SECURITY: Fix Stored-dom XSS via Facebook Oneboxes

2024-07-03 20:12:18 +08:00

mailers

DEV: Automatically update groups for test users with explicit TL (#25415)

2024-01-29 17:52:02 +08:00

migrations

DEV: Switch over category settings to new table - Part 3 (#20657)

2023-09-12 09:51:49 +08:00

models

SECURITY: limit the number of characters in watched word replacements.

2024-07-15 19:26:06 +08:00

multisite

DEV: Add S3 upload system specs using minio (#22975)

2023-08-23 11:18:33 +10:00

requests

Backport changes from PR #27811 (#27874)

2024-07-11 22:16:15 -03:00

script/import_scripts

DEV: Allow fab! without block (#24314)

2023-11-09 16:47:59 -06:00

serializers

SECURITY: Update reviewable user serializer payload

2024-07-03 20:12:14 +08:00

services

SECURITY: Don't allow suspending staff users via other_user_ids param

2024-07-03 20:12:25 +08:00

support

DEV: Remove full group refreshes from tests (#25414)

2024-01-25 14:28:26 +08:00

system

FIX: Improve handling of 'PublicExceptions' when bootstrap_error_pages enabled (#26737)

2024-04-24 10:32:51 +01:00

tasks

DEV: Add file_size_restriction site setting type (#24704)

2023-12-13 16:22:48 -07:00

views

FIX: Use subfolder-safe url for category in html view (#24595)

2023-11-28 19:08:14 +08:00

rails_helper.rb

DEV: Add early support for aarch64 dev env

2024-01-30 15:50:44 +01:00

regenerate_swagger_docs

DEV: Add API docs for uploads and API doc watcher (#15387)

2021-12-23 08:40:15 +10:00

swagger_helper.rb

DEV: Bump rswag-specs from 2.11.0 to 2.13.0 (#24654)

2023-12-07 08:16:47 +08:00