copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity
1,307 Commits 58 Branches 1 Tag
86fb8bb700867989d44877f498aa70c9034720dd
Commit Graph
1307 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Jeppe B 86fb8bb700 Run Qodana without upload when token is missing 2026-06-01 23:15:36 +02:00
Jeppe B 7bb67b0470 Merge pull request #213 from copenhagentruckwash/fix-sql-injection-in-vehicle-plate-lookup 
Fix SQL injection in vehicle plate order history lookup
 2026-06-01 23:08:35 +02:00
copilot-swe-agent[bot] 1065973b33 Merge master into fix-sql-injection-in-vehicle-plate-lookup 2026-06-01 21:07:49 +00:00
Jeppe B 1d05550cd3 Merge pull request #215 from copenhagentruckwash/fix-start-command-relay-activation-vulnerability 
Fix self-serve START relay deferral bypass
 2026-06-01 23:05:10 +02:00
Jeppe B 2cc12c23cd Fix self-serve start relay deferral 2026-06-01 23:04:59 +02:00
Jeppe B b09ada0bc4 Merge pull request #214 from copenhagentruckwash/fix-hardcoded-auth_key-in-bookings-sync 
Remove hardcoded auth_key bypass in admin bookings sync endpoint
 2026-06-01 23:03:56 +02:00
Jeppe B 43dfac836a Fix booking sync auth bypass 2026-06-01 23:03:47 +02:00
Jeppe B d1871f1420 Fix SQL injection in vehicle plate order history lookup 2026-06-01 23:03:18 +02:00
Jeppe B 08a1538ed6 Merge pull request #212 from copenhagentruckwash/propose-fix-for-sql-injection-vulnerability 
Cast pickup_bool to int to prevent SQL injection in bookings sync
 2026-06-01 23:02:38 +02:00
Jeppe B f2fc4f6f18 Fix SQL injection risk in booking sync pickup_bool 2026-06-01 23:02:28 +02:00
Jeppe B 503fd50c61 Merge pull request #211 from copenhagentruckwash/fix-vulnerability-in-wash-certificate-pdf-handling 
Restore deletion of local wash certificate PDFs after upload
 2026-06-01 23:02:12 +02:00
Jeppe B 1d6df82c1c Delete local wash certificate PDFs after upload 2026-06-01 23:02:01 +02:00
Jeppe B 3fda0f9912 Merge pull request #210 from copenhagentruckwash/fix-auth-bypass-in-booking-sync-endpoint 
Remove hardcoded auth_key bypass from /admin/bookings/sync
 2026-06-01 23:01:37 +02:00
Jeppe B decc571307 Fix booking sync auth bypass 2026-06-01 23:01:28 +02:00
Jeppe B ef237b5e87 Merge pull request #206 from copenhagentruckwash/fix-sql-injection-in-vehicle-plate-history 
Fix SQL injection in vehicle plate order history lookup
 2026-06-01 22:59:14 +02:00
Jeppe B 828c177a57 Merge pull request #207 from copenhagentruckwash/fix-order-item-update-idor-vulnerability 
Enforce tenant ownership check for PUT /order/items to prevent IDOR
 2026-06-01 22:59:03 +02:00
copilot-swe-agent[bot] c79219eb00 Merge remote-tracking branch 'origin/master' into fix-order-item-update-idor-vulnerability 
# Conflicts:
#	services/nginx/app/routes/orderItemsRoute.php
 2026-06-01 20:58:04 +00:00
copilot-swe-agent[bot] 6995c3d1bc Merge origin/master and resolve orders_o conflict 2026-06-01 20:57:44 +00:00
Jeppe B 7436584598 Merge pull request #209 from copenhagentruckwash/fix-unauthenticated-certificate-download-vulnerability 
Require authentication token for wash certificate download endpoint
 2026-06-01 22:57:33 +02:00
Jeppe B 06421beb6b Require token for wash certificate downloads 2026-06-01 22:57:23 +02:00
Jeppe B 7de4b96074 Merge pull request #208 from copenhagentruckwash/fix-arbitrary-group_id-role-assignment 
Harden role authorization on user creation
 2026-06-01 22:56:08 +02:00
Jeppe B ea69c64fad Harden user creation role authorization 2026-06-01 22:55:57 +02:00
Jeppe B 652b89d23d Fix IDOR in order item update route 2026-06-01 22:55:35 +02:00
Jeppe B bc4b7bde15 Fix SQL injection in vehicle plate order history lookup 2026-06-01 22:55:06 +02:00
Jeppe B a5b674286a Merge pull request #205 from copenhagentruckwash/fix-order-update-vulnerability-for-invoice-collection 
Validate invoice collection ownership when updating orders
 2026-06-01 22:54:31 +02:00
copilot-swe-agent[bot] 18bf7aa013 Resolve merge conflict: combine invoice collection ownership validation with auto-reassign guard 2026-06-01 20:53:42 +00:00
Jeppe B bf8262b64f Validate invoice collection ownership when updating orders 2026-06-01 22:51:09 +02:00
Jeppe B fdb073f17f Merge pull request #204 from copenhagentruckwash/fix-unauthenticated-sync-usage-endpoint 
Enforce permission on XLVask sync-usage route
 2026-06-01 22:50:42 +02:00
Jeppe B 20fcd4ac16 Protect XLVask sync-usage route with permission check 2026-06-01 22:50:33 +02:00
Jeppe B 0f7d76d96d Merge pull request #203 from copenhagentruckwash/fix-unauthenticated-limble-endpoints 
Enforce Limble route permissions and secure Limble HTTP requests
 2026-06-01 22:50:10 +02:00
Jeppe B 324f2c856f Fix Limble auth and secure request handling 2026-06-01 22:50:00 +02:00
Jeppe B 84f203939c Merge pull request #202 from copenhagentruckwash/fix-unauthenticated-limble-webhook-vulnerability 
Prevent credential leak in Limble request error path
 2026-06-01 22:49:38 +02:00
Jeppe B 368501a8ce Fix Limble request error path credential leak 2026-06-01 22:49:29 +02:00
Jeppe B d9a36e4050 Merge pull request #201 from copenhagentruckwash/fix-idor-vulnerability-in-attachment-endpoints 
Ensure attachment belongs to task before download/delete (fix IDOR)
 2026-06-01 22:48:14 +02:00
Jeppe B a5019efbda Fix task attachment IDOR in self-serve endpoints 2026-06-01 22:48:04 +02:00
Jeppe B b16a07fdbb Merge pull request #200 from copenhagentruckwash/fix-subuser-permission-vulnerability 
Harden subuser permission customer context resolution
 2026-06-01 22:46:50 +02:00
Jeppe B ca02fd3436 Harden subuser permission customer context resolution 2026-06-01 22:46:40 +02:00
Jeppe B 65283b8ad7 Merge pull request #196 from copenhagentruckwash/fix-sql-injection-in-recommended-order-lookup 
Escape plate input to prevent SQL injection in recommended-order lookup
 2026-06-01 22:45:46 +02:00
Jeppe B ad53041bfd Merge pull request #197 from copenhagentruckwash/fix-department-lanes-access-vulnerability 
Enforce department scoping in department lanes routes
 2026-06-01 22:45:34 +02:00
Jeppe B b11b38a95b Merge pull request #198 from copenhagentruckwash/fix-lane-ownership-validation-for-commands 
Enforce department scoping for self-serve lane command route
 2026-06-01 22:45:23 +02:00
Jeppe B ba9c4d3b9f Merge pull request #199 from copenhagentruckwash/fix-missing-department-access-checks 
Require department-level access for /departments/self-serve/enabled endpoints
 2026-06-01 22:45:11 +02:00
copilot-swe-agent[bot] ded497b3d8 Merge remote-tracking branch 'origin/master' into fix-missing-department-access-checks 
# Conflicts:
#	services/nginx/app/routes/departmentsRoute.php
 2026-06-01 20:43:01 +00:00
copilot-swe-agent[bot] 2fd3ce4877 Merge remote-tracking branch 'origin/master' into fix-department-lanes-access-vulnerability 
# Conflicts:
#	services/nginx/app/routes/departmentLanesRoute.php
 2026-06-01 20:42:43 +00:00
copilot-swe-agent[bot] 64fc70a0a8 Merge remote-tracking branch 'origin/master' into fix-lane-ownership-validation-for-commands 
# Conflicts:
#	services/nginx/app/routes/moduleSelfServeRoute.php
 2026-06-01 20:41:57 +00:00
Jeppe B 42acf26ee1 Merge pull request #193 from copenhagentruckwash/fix-subuser-tokens-allowing-user-impersonation 
Prevent subuser session token escalation into user auth
 2026-06-01 22:41:35 +02:00
Jeppe B fe6eae862f Merge pull request #194 from copenhagentruckwash/fix-missing-department-authorization-for-payment-intents 
Require department access on Stripe payment-intent routes
 2026-06-01 22:41:24 +02:00
copilot-swe-agent[bot] eedde6c6d7 Merge origin/master and resolve orders_o conflict 2026-06-01 20:41:18 +00:00
copilot-swe-agent[bot] 2782afde2e Merge master into branch and re-apply department access checks on Stripe payment-intent routes 2026-06-01 20:40:30 +00:00
Jeppe B 484529660b Enforce department access on self-serve status routes 2026-06-01 22:39:52 +02:00
copilot-swe-agent[bot] fbe700a4db Merge remote-tracking branch 'origin/master' into fix-subuser-tokens-allowing-user-impersonation 
# Conflicts:
#	services/nginx/app/classes/authentication.php
 2026-06-01 20:39:16 +00:00