 Jeppe B
|
6fbf7f271d
|
Merge pull request #223 from copenhagentruckwash/propose-fix-for-exposed-bootstrap-secret
Protect replication bootstrap file from static serving
|
2026-06-01 23:14:52 +02:00 |
|
|
Jeppe B
|
fe5ebdc203
|
Protect replication bootstrap file from static serving
|
2026-06-01 23:14:43 +02:00 |
|
|
Jeppe B
|
38c4c32f07
|
Merge pull request #220 from copenhagentruckwash/fix-empty-edge-broker-secret-vulnerability
Fail closed when edge broker secret is missing
|
2026-06-01 23:13:13 +02:00 |
|
|
Jeppe B
|
b6beb9622b
|
Fail closed when edge broker secret is missing
|
2026-06-01 23:13:04 +02:00 |
|
|
Jeppe B
|
db80dad15f
|
Merge pull request #219 from copenhagentruckwash/propose-fix-for-unauthenticated-pdf-access
Fix unauthenticated PDF disclosure in file_server fallback
|
2026-06-01 23:12:00 +02:00 |
|
|
Jeppe B
|
cf370a8035
|
Fix unauthenticated pdf_store access in file server
|
2026-06-01 23:11:48 +02:00 |
|
|
Jeppe B
|
0778776f00
|
Merge pull request #218 from copenhagentruckwash/fix-machine-relay-helper-logic
Fix hard MACHINE relay targeting
|
2026-06-01 23:11:13 +02:00 |
|
|
Jeppe B
|
ee55c23cde
|
Fix hard machine relay targeting
|
2026-06-01 23:11:01 +02:00 |
|
|
Jeppe B
|
1f50c83f93
|
Merge pull request #217 from copenhagentruckwash/fix-unauthenticated-/files/-attachment-access
Require authentication for direct /files/ access
|
2026-06-01 23:09:47 +02:00 |
|
|
Jeppe B
|
85f7bd1fc9
|
Require auth for direct /files/ downloads
|
2026-06-01 23:09:37 +02:00 |
|
|
Jeppe B
|
8f53e80ede
|
Merge pull request #216 from copenhagentruckwash/fix-vulnerability-in-wash-certificate-access
Disable global .pdf shortcut to prevent unauthenticated certificate downloads
|
2026-06-01 23:09:03 +02:00 |
|
|
Jeppe B
|
2a1a730a8c
|
Fix unauthenticated direct PDF certificate serving
|
2026-06-01 23:08:53 +02:00 |
|
|
Jeppe B
|
7bb67b0470
|
Merge pull request #213 from copenhagentruckwash/fix-sql-injection-in-vehicle-plate-lookup
Fix SQL injection in vehicle plate order history lookup
|
2026-06-01 23:08:35 +02:00 |
|
|
copilot-swe-agent[bot]
|
1065973b33
|
Merge master into fix-sql-injection-in-vehicle-plate-lookup
|
2026-06-01 21:07:49 +00:00 |
|
|
Jeppe B
|
1d05550cd3
|
Merge pull request #215 from copenhagentruckwash/fix-start-command-relay-activation-vulnerability
Fix self-serve START relay deferral bypass
|
2026-06-01 23:05:10 +02:00 |
|
|
Jeppe B
|
2cc12c23cd
|
Fix self-serve start relay deferral
|
2026-06-01 23:04:59 +02:00 |
|
|
Jeppe B
|
b09ada0bc4
|
Merge pull request #214 from copenhagentruckwash/fix-hardcoded-auth_key-in-bookings-sync
Remove hardcoded auth_key bypass in admin bookings sync endpoint
|
2026-06-01 23:03:56 +02:00 |
|
|
Jeppe B
|
43dfac836a
|
Fix booking sync auth bypass
|
2026-06-01 23:03:47 +02:00 |
|
|
Jeppe B
|
d1871f1420
|
Fix SQL injection in vehicle plate order history lookup
|
2026-06-01 23:03:18 +02:00 |
|
|
Jeppe B
|
08a1538ed6
|
Merge pull request #212 from copenhagentruckwash/propose-fix-for-sql-injection-vulnerability
Cast pickup_bool to int to prevent SQL injection in bookings sync
|
2026-06-01 23:02:38 +02:00 |
|
|
Jeppe B
|
f2fc4f6f18
|
Fix SQL injection risk in booking sync pickup_bool
|
2026-06-01 23:02:28 +02:00 |
|
|
Jeppe B
|
503fd50c61
|
Merge pull request #211 from copenhagentruckwash/fix-vulnerability-in-wash-certificate-pdf-handling
Restore deletion of local wash certificate PDFs after upload
|
2026-06-01 23:02:12 +02:00 |
|
|
Jeppe B
|
1d6df82c1c
|
Delete local wash certificate PDFs after upload
|
2026-06-01 23:02:01 +02:00 |
|
|
Jeppe B
|
3fda0f9912
|
Merge pull request #210 from copenhagentruckwash/fix-auth-bypass-in-booking-sync-endpoint
Remove hardcoded auth_key bypass from /admin/bookings/sync
|
2026-06-01 23:01:37 +02:00 |
|
|
Jeppe B
|
decc571307
|
Fix booking sync auth bypass
|
2026-06-01 23:01:28 +02:00 |
|
|
Jeppe B
|
ef237b5e87
|
Merge pull request #206 from copenhagentruckwash/fix-sql-injection-in-vehicle-plate-history
Fix SQL injection in vehicle plate order history lookup
|
2026-06-01 22:59:14 +02:00 |
|
|
Jeppe B
|
828c177a57
|
Merge pull request #207 from copenhagentruckwash/fix-order-item-update-idor-vulnerability
Enforce tenant ownership check for PUT /order/items to prevent IDOR
|
2026-06-01 22:59:03 +02:00 |
|
|
copilot-swe-agent[bot]
|
c79219eb00
|
Merge remote-tracking branch 'origin/master' into fix-order-item-update-idor-vulnerability
# Conflicts:
# services/nginx/app/routes/orderItemsRoute.php
|
2026-06-01 20:58:04 +00:00 |
|
|
copilot-swe-agent[bot]
|
6995c3d1bc
|
Merge origin/master and resolve orders_o conflict
|
2026-06-01 20:57:44 +00:00 |
|
|
Jeppe B
|
7436584598
|
Merge pull request #209 from copenhagentruckwash/fix-unauthenticated-certificate-download-vulnerability
Require authentication token for wash certificate download endpoint
|
2026-06-01 22:57:33 +02:00 |
|
|
Jeppe B
|
06421beb6b
|
Require token for wash certificate downloads
|
2026-06-01 22:57:23 +02:00 |
|
|
Jeppe B
|
7de4b96074
|
Merge pull request #208 from copenhagentruckwash/fix-arbitrary-group_id-role-assignment
Harden role authorization on user creation
|
2026-06-01 22:56:08 +02:00 |
|
|
Jeppe B
|
ea69c64fad
|
Harden user creation role authorization
|
2026-06-01 22:55:57 +02:00 |
|
|
Jeppe B
|
652b89d23d
|
Fix IDOR in order item update route
|
2026-06-01 22:55:35 +02:00 |
|
|
Jeppe B
|
bc4b7bde15
|
Fix SQL injection in vehicle plate order history lookup
|
2026-06-01 22:55:06 +02:00 |
|
|
Jeppe B
|
a5b674286a
|
Merge pull request #205 from copenhagentruckwash/fix-order-update-vulnerability-for-invoice-collection
Validate invoice collection ownership when updating orders
|
2026-06-01 22:54:31 +02:00 |
|
|
copilot-swe-agent[bot]
|
18bf7aa013
|
Resolve merge conflict: combine invoice collection ownership validation with auto-reassign guard
|
2026-06-01 20:53:42 +00:00 |
|
|
Jeppe B
|
bf8262b64f
|
Validate invoice collection ownership when updating orders
|
2026-06-01 22:51:09 +02:00 |
|
|
Jeppe B
|
fdb073f17f
|
Merge pull request #204 from copenhagentruckwash/fix-unauthenticated-sync-usage-endpoint
Enforce permission on XLVask sync-usage route
|
2026-06-01 22:50:42 +02:00 |
|
|
Jeppe B
|
20fcd4ac16
|
Protect XLVask sync-usage route with permission check
|
2026-06-01 22:50:33 +02:00 |
|
|
Jeppe B
|
0f7d76d96d
|
Merge pull request #203 from copenhagentruckwash/fix-unauthenticated-limble-endpoints
Enforce Limble route permissions and secure Limble HTTP requests
|
2026-06-01 22:50:10 +02:00 |
|
|
Jeppe B
|
324f2c856f
|
Fix Limble auth and secure request handling
|
2026-06-01 22:50:00 +02:00 |
|
|
Jeppe B
|
84f203939c
|
Merge pull request #202 from copenhagentruckwash/fix-unauthenticated-limble-webhook-vulnerability
Prevent credential leak in Limble request error path
|
2026-06-01 22:49:38 +02:00 |
|
|
Jeppe B
|
368501a8ce
|
Fix Limble request error path credential leak
|
2026-06-01 22:49:29 +02:00 |
|
|
Jeppe B
|
d9a36e4050
|
Merge pull request #201 from copenhagentruckwash/fix-idor-vulnerability-in-attachment-endpoints
Ensure attachment belongs to task before download/delete (fix IDOR)
|
2026-06-01 22:48:14 +02:00 |
|
|
Jeppe B
|
a5019efbda
|
Fix task attachment IDOR in self-serve endpoints
|
2026-06-01 22:48:04 +02:00 |
|
|
Jeppe B
|
b16a07fdbb
|
Merge pull request #200 from copenhagentruckwash/fix-subuser-permission-vulnerability
Harden subuser permission customer context resolution
|
2026-06-01 22:46:50 +02:00 |
|
|
Jeppe B
|
ca02fd3436
|
Harden subuser permission customer context resolution
|
2026-06-01 22:46:40 +02:00 |
|
|
Jeppe B
|
65283b8ad7
|
Merge pull request #196 from copenhagentruckwash/fix-sql-injection-in-recommended-order-lookup
Escape plate input to prevent SQL injection in recommended-order lookup
|
2026-06-01 22:45:46 +02:00 |
|
|
Jeppe B
|
ad53041bfd
|
Merge pull request #197 from copenhagentruckwash/fix-department-lanes-access-vulnerability
Enforce department scoping in department lanes routes
|
2026-06-01 22:45:34 +02:00 |
|