 Jeppe B
|
ba9c4d3b9f
|
Merge pull request #199 from copenhagentruckwash/fix-missing-department-access-checks
Require department-level access for /departments/self-serve/enabled endpoints
|
2026-06-01 22:45:11 +02:00 |
|
|
copilot-swe-agent[bot]
|
ded497b3d8
|
Merge remote-tracking branch 'origin/master' into fix-missing-department-access-checks
# Conflicts:
# services/nginx/app/routes/departmentsRoute.php
|
2026-06-01 20:43:01 +00:00 |
|
|
Jeppe B
|
42acf26ee1
|
Merge pull request #193 from copenhagentruckwash/fix-subuser-tokens-allowing-user-impersonation
Prevent subuser session token escalation into user auth
|
2026-06-01 22:41:35 +02:00 |
|
|
Jeppe B
|
fe6eae862f
|
Merge pull request #194 from copenhagentruckwash/fix-missing-department-authorization-for-payment-intents
Require department access on Stripe payment-intent routes
|
2026-06-01 22:41:24 +02:00 |
|
|
copilot-swe-agent[bot]
|
2782afde2e
|
Merge master into branch and re-apply department access checks on Stripe payment-intent routes
|
2026-06-01 20:40:30 +00:00 |
|
|
Jeppe B
|
484529660b
|
Enforce department access on self-serve status routes
|
2026-06-01 22:39:52 +02:00 |
|
|
copilot-swe-agent[bot]
|
fbe700a4db
|
Merge remote-tracking branch 'origin/master' into fix-subuser-tokens-allowing-user-impersonation
# Conflicts:
# services/nginx/app/classes/authentication.php
|
2026-06-01 20:39:16 +00:00 |
|
|
Jeppe B
|
b3225c8d8b
|
Merge pull request #195 from copenhagentruckwash/fix-sql-injection-in-filter-handling
Fix SQL injection in array-based pagination filters
|
2026-06-01 22:37:38 +02:00 |
|
|
Jeppe B
|
0f96247bf3
|
Fix SQL injection in array pagination filters
|
2026-06-01 22:37:28 +02:00 |
|
|
Jeppe B
|
4703e07951
|
Enforce department access on Stripe payment intent order routes
|
2026-06-01 22:36:49 +02:00 |
|
|
Jeppe B
|
7ddda9ab03
|
Merge pull request #190 from copenhagentruckwash/fix-2fa-token-validation-bypass
Enforce auth token types to prevent 2FA bypass
|
2026-06-01 22:36:18 +02:00 |
|
|
copilot-swe-agent[bot]
|
4e9575cd87
|
Merge master and resolve conflict: use rawToken in get_user() exception-handled lookup
|
2026-06-01 20:35:51 +00:00 |
|
|
Jeppe B
|
ef82a95feb
|
Merge pull request #186 from copenhagentruckwash/propose-fix-for-edge-broker-vulnerability
Harden edge broker defaults and restrict compose exposure
|
2026-06-01 22:35:45 +02:00 |
|
|
Jeppe B
|
fd4ec3dda2
|
Fix subuser token confusion in user auth flow
|
2026-06-01 22:35:24 +02:00 |
|
|
Jeppe B
|
1616bd431a
|
Merge pull request #192 from copenhagentruckwash/fix-subuser-permission-evaluation-vulnerability
Use resolved customer context in subuser permission checks
|
2026-06-01 22:34:56 +02:00 |
|
|
copilot-swe-agent[bot]
|
334a7a4401
|
Merge origin/master into propose-fix-for-edge-broker-vulnerability, resolving conflicts
|
2026-06-01 20:34:47 +00:00 |
|
|
Jeppe B
|
22dd9f9c07
|
Fix subuser permission checks to use resolved customer context
|
2026-06-01 22:34:45 +02:00 |
|
|
Jeppe B
|
5684da1bc7
|
Merge pull request #191 from copenhagentruckwash/fix-sql-injection-in-gate/relay-creation
Escape JSON-encoded values in add_object to prevent SQL injection
|
2026-06-01 22:34:00 +02:00 |
|
|
Jeppe B
|
69cd039322
|
Escape JSON values in add_object inserts
|
2026-06-01 22:33:49 +02:00 |
|
|
Jeppe B
|
0dc7f813a8
|
Merge pull request #188 from copenhagentruckwash/propose-fix-for-relay-control-bypass-vulnerability
Fix self-serve relay sync to enforce lane safety guards
|
2026-06-01 22:33:11 +02:00 |
|
|
copilot-swe-agent[bot]
|
a828e9bc25
|
Merge origin/master into propose-fix-for-edge-broker-vulnerability, resolving all conflicts
|
2026-06-01 20:27:11 +00:00 |
|
|
copilot-swe-agent[bot]
|
8d2e71aaf3
|
Merge origin/master and resolve self-serve relay sync conflicts
|
2026-06-01 20:23:09 +00:00 |
|
|
Jeppe B
|
721e2670dd
|
Reject 2FA verification tokens for API authentication
|
2026-06-01 22:22:42 +02:00 |
|
|
Jeppe B
|
b03500d2d1
|
Merge pull request #189 from copenhagentruckwash/fix-subuser-token-authorization-vulnerability
Validate subuser grants before resolving subuser customer context
|
2026-06-01 22:21:58 +02:00 |
|
|
Jeppe B
|
ed9ebc2ac8
|
Validate subuser grants before resolving customer user
|
2026-06-01 22:21:44 +02:00 |
|
|
Jeppe B
|
64beb38bae
|
Fix self-serve relay sync to enforce lane safety guards
|
2026-06-01 22:19:34 +02:00 |
|
|
Jeppe B
|
e13bbae01f
|
Merge pull request #184 from copenhagentruckwash/fix-edge-broker-default-shared-secret-issue
Harden edge broker shared secret defaults
|
2026-06-01 22:17:57 +02:00 |
|
|
Jeppe B
|
5ba0f5f9ba
|
Merge pull request #183 from copenhagentruckwash/fix-credential-exposure-in-.env.old
Remove leaked `.env.old` with credentials and add to `.gitignore`
|
2026-06-01 22:17:30 +02:00 |
|
|
Jeppe B
|
bb5f1db1b3
|
Merge branch 'master' into fix-credential-exposure-in-.env.old
|
2026-06-01 22:17:21 +02:00 |
|
|
copilot-swe-agent[bot]
|
cb63d10415
|
Merge origin/master into fix-edge-broker-default-shared-secret-issue
|
2026-06-01 20:12:06 +00:00 |
|
|
Jeppe B
|
4183c3928c
|
Merge pull request #187 from copenhagentruckwash/fix-hard-coded-tokens-in-test-file
Sanitize leaked credentials in test/orderBookingsPost.http
|
2026-06-01 22:11:38 +02:00 |
|
|
Jeppe B
|
28bae85b2a
|
Sanitize leaked credentials in order booking HTTP template
|
2026-06-01 22:11:23 +02:00 |
|
|
Jeppe B
|
f2db92de09
|
Harden edge broker defaults and compose exposure
|
2026-06-01 22:10:14 +02:00 |
|
|
Jeppe B
|
a41334f513
|
Merge pull request #185 from copenhagentruckwash/fix-mysql-debug-exposure-vulnerability
Harden mysql-debug compose service configuration
|
2026-06-01 22:09:46 +02:00 |
|
|
Jeppe B
|
175fb3a35f
|
Harden mysql-debug compose service configuration
|
2026-06-01 22:09:35 +02:00 |
|
|
copilot-swe-agent[bot]
|
8e6b29810a
|
Clean up resolved gitignore merge
|
2026-06-01 20:08:24 +00:00 |
|
|
Jeppe B
|
21e9b2c80f
|
Harden edge broker shared secret defaults
|
2026-06-01 22:08:20 +02:00 |
|
|
copilot-swe-agent[bot]
|
989d04167a
|
Resolve .gitignore merge conflict with master
|
2026-06-01 20:07:48 +00:00 |
|
|
Jeppe B
|
286127c390
|
Merge pull request #182 from copenhagentruckwash/fix-edge-broker-default-shared-secret-issue
Remove insecure default edge broker shared secret and stop exposing port 4300
|
2026-06-01 22:07:10 +02:00 |
|
|
copilot-swe-agent[bot]
|
2ba87a4850
|
Start merge conflict resolution
|
2026-06-01 20:06:07 +00:00 |
|
|
Jeppe B
|
6658af814b
|
Remove committed env backup with secrets
|
2026-06-01 22:04:11 +02:00 |
|
|
Jeppe B
|
2abd6d04e9
|
Merge pull request #180 from copenhagentruckwash/fix-edge-broker-vulnerability-in-repository
Harden edge broker compose defaults
|
2026-06-01 22:02:41 +02:00 |
|
|
copilot-swe-agent[bot]
|
3107779b74
|
Resolve merge conflicts with origin/master
|
2026-06-01 20:02:21 +00:00 |
|
|
Jeppe B
|
61a09dce87
|
Remove insecure default edge broker secret fallback
|
2026-06-01 22:01:39 +02:00 |
|
|
Jeppe B
|
a02ed69108
|
Merge pull request #181 from copenhagentruckwash/fix-remote-root-shell-execution-vulnerability
Gate edge-agent shell actions behind local opt-in
|
2026-06-01 22:01:01 +02:00 |
|
|
Jeppe B
|
9b69aadca4
|
Gate edge-agent shell actions behind local opt-in
|
2026-06-01 22:00:49 +02:00 |
|
|
Jeppe B
|
6204fb50f9
|
Harden edge broker compose defaults
|
2026-06-01 21:59:27 +02:00 |
|
|
Jeppe B
|
0a6a8aeab2
|
Merge pull request #179 from copenhagentruckwash/fix-vulnerability-in-ci-workflow
Harden tests workflow: run PR jobs on GitHub-hosted runners
|
2026-06-01 21:57:15 +02:00 |
|
|
copilot-swe-agent[bot]
|
7c21b6463d
|
Merge origin/master and resolve workflow conflicts
|
2026-06-01 19:55:27 +00:00 |
|
|
Jeppe B
|
d97cfda0ea
|
Harden CI by avoiding self-hosted runners on PR workflow
|
2026-06-01 21:48:39 +02:00 |
|