 Jeppe B
|
ad53041bfd
|
Merge pull request #197 from copenhagentruckwash/fix-department-lanes-access-vulnerability
Enforce department scoping in department lanes routes
|
2026-06-01 22:45:34 +02:00 |
|
|
Jeppe B
|
b11b38a95b
|
Merge pull request #198 from copenhagentruckwash/fix-lane-ownership-validation-for-commands
Enforce department scoping for self-serve lane command route
|
2026-06-01 22:45:23 +02:00 |
|
|
copilot-swe-agent[bot]
|
ded497b3d8
|
Merge remote-tracking branch 'origin/master' into fix-missing-department-access-checks
# Conflicts:
# services/nginx/app/routes/departmentsRoute.php
|
2026-06-01 20:43:01 +00:00 |
|
|
copilot-swe-agent[bot]
|
2fd3ce4877
|
Merge remote-tracking branch 'origin/master' into fix-department-lanes-access-vulnerability
# Conflicts:
# services/nginx/app/routes/departmentLanesRoute.php
|
2026-06-01 20:42:43 +00:00 |
|
|
copilot-swe-agent[bot]
|
64fc70a0a8
|
Merge remote-tracking branch 'origin/master' into fix-lane-ownership-validation-for-commands
# Conflicts:
# services/nginx/app/routes/moduleSelfServeRoute.php
|
2026-06-01 20:41:57 +00:00 |
|
|
Jeppe B
|
42acf26ee1
|
Merge pull request #193 from copenhagentruckwash/fix-subuser-tokens-allowing-user-impersonation
Prevent subuser session token escalation into user auth
|
2026-06-01 22:41:35 +02:00 |
|
|
copilot-swe-agent[bot]
|
2782afde2e
|
Merge master into branch and re-apply department access checks on Stripe payment-intent routes
|
2026-06-01 20:40:30 +00:00 |
|
|
Jeppe B
|
484529660b
|
Enforce department access on self-serve status routes
|
2026-06-01 22:39:52 +02:00 |
|
|
copilot-swe-agent[bot]
|
fbe700a4db
|
Merge remote-tracking branch 'origin/master' into fix-subuser-tokens-allowing-user-impersonation
# Conflicts:
# services/nginx/app/classes/authentication.php
|
2026-06-01 20:39:16 +00:00 |
|
|
Jeppe B
|
6225c4b072
|
Enforce department access for self-serve lane commands
|
2026-06-01 22:39:14 +02:00 |
|
|
Jeppe B
|
300a37fce3
|
Enforce department access in department lanes routes
|
2026-06-01 22:38:53 +02:00 |
|
|
Jeppe B
|
b3225c8d8b
|
Merge pull request #195 from copenhagentruckwash/fix-sql-injection-in-filter-handling
Fix SQL injection in array-based pagination filters
|
2026-06-01 22:37:38 +02:00 |
|
|
Jeppe B
|
0f96247bf3
|
Fix SQL injection in array pagination filters
|
2026-06-01 22:37:28 +02:00 |
|
|
Jeppe B
|
4703e07951
|
Enforce department access on Stripe payment intent order routes
|
2026-06-01 22:36:49 +02:00 |
|
|
Jeppe B
|
7ddda9ab03
|
Merge pull request #190 from copenhagentruckwash/fix-2fa-token-validation-bypass
Enforce auth token types to prevent 2FA bypass
|
2026-06-01 22:36:18 +02:00 |
|
|
copilot-swe-agent[bot]
|
4e9575cd87
|
Merge master and resolve conflict: use rawToken in get_user() exception-handled lookup
|
2026-06-01 20:35:51 +00:00 |
|
|
Jeppe B
|
ef82a95feb
|
Merge pull request #186 from copenhagentruckwash/propose-fix-for-edge-broker-vulnerability
Harden edge broker defaults and restrict compose exposure
|
2026-06-01 22:35:45 +02:00 |
|
|
Jeppe B
|
fd4ec3dda2
|
Fix subuser token confusion in user auth flow
|
2026-06-01 22:35:24 +02:00 |
|
|
Jeppe B
|
1616bd431a
|
Merge pull request #192 from copenhagentruckwash/fix-subuser-permission-evaluation-vulnerability
Use resolved customer context in subuser permission checks
|
2026-06-01 22:34:56 +02:00 |
|
|
copilot-swe-agent[bot]
|
334a7a4401
|
Merge origin/master into propose-fix-for-edge-broker-vulnerability, resolving conflicts
|
2026-06-01 20:34:47 +00:00 |
|
|
Jeppe B
|
22dd9f9c07
|
Fix subuser permission checks to use resolved customer context
|
2026-06-01 22:34:45 +02:00 |
|
|
Jeppe B
|
5684da1bc7
|
Merge pull request #191 from copenhagentruckwash/fix-sql-injection-in-gate/relay-creation
Escape JSON-encoded values in add_object to prevent SQL injection
|
2026-06-01 22:34:00 +02:00 |
|
|
Jeppe B
|
69cd039322
|
Escape JSON values in add_object inserts
|
2026-06-01 22:33:49 +02:00 |
|
|
Jeppe B
|
0dc7f813a8
|
Merge pull request #188 from copenhagentruckwash/propose-fix-for-relay-control-bypass-vulnerability
Fix self-serve relay sync to enforce lane safety guards
|
2026-06-01 22:33:11 +02:00 |
|
|
copilot-swe-agent[bot]
|
a828e9bc25
|
Merge origin/master into propose-fix-for-edge-broker-vulnerability, resolving all conflicts
|
2026-06-01 20:27:11 +00:00 |
|
|
copilot-swe-agent[bot]
|
8d2e71aaf3
|
Merge origin/master and resolve self-serve relay sync conflicts
|
2026-06-01 20:23:09 +00:00 |
|
|
Jeppe B
|
721e2670dd
|
Reject 2FA verification tokens for API authentication
|
2026-06-01 22:22:42 +02:00 |
|
|
Jeppe B
|
b03500d2d1
|
Merge pull request #189 from copenhagentruckwash/fix-subuser-token-authorization-vulnerability
Validate subuser grants before resolving subuser customer context
|
2026-06-01 22:21:58 +02:00 |
|
|
Jeppe B
|
ed9ebc2ac8
|
Validate subuser grants before resolving customer user
|
2026-06-01 22:21:44 +02:00 |
|
|
Jeppe B
|
64beb38bae
|
Fix self-serve relay sync to enforce lane safety guards
|
2026-06-01 22:19:34 +02:00 |
|
|
Jeppe B
|
f2db92de09
|
Harden edge broker defaults and compose exposure
|
2026-06-01 22:10:14 +02:00 |
|
|
copilot-swe-agent[bot]
|
2ba87a4850
|
Start merge conflict resolution
|
2026-06-01 20:06:07 +00:00 |
|
|
copilot-swe-agent[bot]
|
3107779b74
|
Resolve merge conflicts with origin/master
|
2026-06-01 20:02:21 +00:00 |
|
|
Jeppe B
|
61a09dce87
|
Remove insecure default edge broker secret fallback
|
2026-06-01 22:01:39 +02:00 |
|
|
Jeppe B
|
a02ed69108
|
Merge pull request #181 from copenhagentruckwash/fix-remote-root-shell-execution-vulnerability
Gate edge-agent shell actions behind local opt-in
|
2026-06-01 22:01:01 +02:00 |
|
|
Jeppe B
|
9b69aadca4
|
Gate edge-agent shell actions behind local opt-in
|
2026-06-01 22:00:49 +02:00 |
|
|
Jeppe B
|
6204fb50f9
|
Harden edge broker compose defaults
|
2026-06-01 21:59:27 +02:00 |
|
|
Jeppe B
|
aad5d77f41
|
Merge pull request #178 from copenhagentruckwash/propose-fix-for-exposure-of-sensitive-logs
Remove committed Caddy access log containing leaked secrets
|
2026-06-01 21:47:33 +02:00 |
|
|
Jeppe B
|
3b132cad95
|
Merge pull request #176 from copenhagentruckwash/fix-property-gate-command-authorization-bypass
Restore explicit permissions for property gate commands to fix authorization bypass
|
2026-06-01 21:03:30 +02:00 |
|
|
copilot-swe-agent[bot]
|
ab957092bd
|
Merge origin/master into propose-fix-for-exposure-of-sensitive-logs
|
2026-06-01 19:03:25 +00:00 |
|
|
copilot-swe-agent[bot]
|
b8f65f242f
|
Merge origin/master and resolve property gate conflict
|
2026-06-01 19:02:11 +00:00 |
|
|
Jeppe B
|
688cb0a664
|
Merge pull request #173 from copenhagentruckwash/fix-cross-tenant-certificate-attachment-vulnerability
Validate booking order context before certificates
|
2026-06-01 21:00:33 +02:00 |
|
|
Jeppe B
|
6eb4171fea
|
Merge pull request #172 from copenhagentruckwash/propose-fix-for-automation-permission-bug
Prevent XL Vask list automation execution
|
2026-06-01 21:00:21 +02:00 |
|
|
Jeppe B
|
ddba27a1be
|
Remove committed Caddy access log with leaked secrets
|
2026-06-01 20:59:59 +02:00 |
|
|
copilot-swe-agent[bot]
|
933b18b988
|
Merge origin/master and resolve booking conflict files
|
2026-06-01 18:59:05 +00:00 |
|
|
Jeppe B
|
18c6852865
|
Merge pull request #177 from copenhagentruckwash/fix-broker-secret-vulnerability-in-api
Harden edge broker shared-secret handling
|
2026-06-01 20:58:58 +02:00 |
|
|
Jeppe B
|
77403965f8
|
Harden edge broker shared-secret handling
|
2026-06-01 20:58:45 +02:00 |
|
|
copilot-swe-agent[bot]
|
a3e2765ad4
|
Merge origin/master and resolve XLVask route contract conflict
|
2026-06-01 18:57:46 +00:00 |
|
|
Jeppe B
|
787db994dd
|
Fix property gate command authorization bypass
|
2026-06-01 20:57:21 +02:00 |
|
|
Jeppe B
|
f8f603a38e
|
Merge pull request #175 from copenhagentruckwash/fix-vulnerability-in-studio-graph-edits
Fix authorization boundary for studio graph lane operations
|
2026-06-01 20:56:51 +02:00 |
|