 Jeppe B
|
eab8394579
|
Fix booking PO default tenant validation
|
2026-06-01 23:23:49 +02:00 |
|
|
Jeppe B
|
b88c2742e8
|
Merge pull request #228 from copenhagentruckwash/fix-partial-release-tests-bypassing-promotion-gate
Require app-scoped release gates for bundle promotion
|
2026-06-01 23:23:34 +02:00 |
|
|
Jeppe B
|
4ea5eeb942
|
Require app-scoped release gates for bundle promotion
|
2026-06-01 23:23:23 +02:00 |
|
|
Jeppe B
|
e41b226529
|
Deny web access to replication bootstrap snapshots
|
2026-06-01 23:19:04 +02:00 |
|
|
Jeppe B
|
7cb248a112
|
Merge pull request #226 from copenhagentruckwash/fix-ssrf-vulnerability-in-release-gate
Harden release gate diagnostics fetches
|
2026-06-01 23:17:01 +02:00 |
|
|
Jeppe B
|
dfa0441266
|
Harden release gate diagnostics fetches
|
2026-06-01 23:16:51 +02:00 |
|
|
Jeppe B
|
d9dbd7dede
|
Merge pull request #225 from copenhagentruckwash/propose-fix-for-coolify-deployment-vulnerability
Prevent Coolify image from embedding replication snapshots
|
2026-06-01 23:16:33 +02:00 |
|
|
Jeppe B
|
3b8463e37f
|
Prevent Coolify image from embedding replication snapshots
|
2026-06-01 23:16:22 +02:00 |
|
|
Jeppe B
|
0e8b527ee4
|
Merge pull request #224 from copenhagentruckwash/fix-qodana-scan-fail-open-issue
Run Qodana locally when cloud token is missing
|
2026-06-01 23:15:47 +02:00 |
|
|
Jeppe B
|
86fb8bb700
|
Run Qodana without upload when token is missing
|
2026-06-01 23:15:36 +02:00 |
|
|
Jeppe B
|
6fbf7f271d
|
Merge pull request #223 from copenhagentruckwash/propose-fix-for-exposed-bootstrap-secret
Protect replication bootstrap file from static serving
|
2026-06-01 23:14:52 +02:00 |
|
|
Jeppe B
|
fe5ebdc203
|
Protect replication bootstrap file from static serving
|
2026-06-01 23:14:43 +02:00 |
|
|
Jeppe B
|
c6dbc0728f
|
Remove hardcoded credentials from orderBookingsPost HTTP examples
|
2026-06-01 23:14:12 +02:00 |
|
|
Jeppe B
|
a0b1dcb3e3
|
Fix system search association expansion for own-only types
|
2026-06-01 23:13:50 +02:00 |
|
|
Jeppe B
|
38c4c32f07
|
Merge pull request #220 from copenhagentruckwash/fix-empty-edge-broker-secret-vulnerability
Fail closed when edge broker secret is missing
|
2026-06-01 23:13:13 +02:00 |
|
|
Jeppe B
|
b6beb9622b
|
Fail closed when edge broker secret is missing
|
2026-06-01 23:13:04 +02:00 |
|
|
Jeppe B
|
db80dad15f
|
Merge pull request #219 from copenhagentruckwash/propose-fix-for-unauthenticated-pdf-access
Fix unauthenticated PDF disclosure in file_server fallback
|
2026-06-01 23:12:00 +02:00 |
|
|
Jeppe B
|
cf370a8035
|
Fix unauthenticated pdf_store access in file server
|
2026-06-01 23:11:48 +02:00 |
|
|
Jeppe B
|
0778776f00
|
Merge pull request #218 from copenhagentruckwash/fix-machine-relay-helper-logic
Fix hard MACHINE relay targeting
|
2026-06-01 23:11:13 +02:00 |
|
|
Jeppe B
|
ee55c23cde
|
Fix hard machine relay targeting
|
2026-06-01 23:11:01 +02:00 |
|
|
Jeppe B
|
1f50c83f93
|
Merge pull request #217 from copenhagentruckwash/fix-unauthenticated-/files/-attachment-access
Require authentication for direct /files/ access
|
2026-06-01 23:09:47 +02:00 |
|
|
Jeppe B
|
85f7bd1fc9
|
Require auth for direct /files/ downloads
|
2026-06-01 23:09:37 +02:00 |
|
|
Jeppe B
|
8f53e80ede
|
Merge pull request #216 from copenhagentruckwash/fix-vulnerability-in-wash-certificate-access
Disable global .pdf shortcut to prevent unauthenticated certificate downloads
|
2026-06-01 23:09:03 +02:00 |
|
|
Jeppe B
|
2a1a730a8c
|
Fix unauthenticated direct PDF certificate serving
|
2026-06-01 23:08:53 +02:00 |
|
|
Jeppe B
|
7bb67b0470
|
Merge pull request #213 from copenhagentruckwash/fix-sql-injection-in-vehicle-plate-lookup
Fix SQL injection in vehicle plate order history lookup
|
2026-06-01 23:08:35 +02:00 |
|
|
copilot-swe-agent[bot]
|
1065973b33
|
Merge master into fix-sql-injection-in-vehicle-plate-lookup
|
2026-06-01 21:07:49 +00:00 |
|
|
Jeppe B
|
1d05550cd3
|
Merge pull request #215 from copenhagentruckwash/fix-start-command-relay-activation-vulnerability
Fix self-serve START relay deferral bypass
|
2026-06-01 23:05:10 +02:00 |
|
|
Jeppe B
|
2cc12c23cd
|
Fix self-serve start relay deferral
|
2026-06-01 23:04:59 +02:00 |
|
|
Jeppe B
|
b09ada0bc4
|
Merge pull request #214 from copenhagentruckwash/fix-hardcoded-auth_key-in-bookings-sync
Remove hardcoded auth_key bypass in admin bookings sync endpoint
|
2026-06-01 23:03:56 +02:00 |
|
|
Jeppe B
|
43dfac836a
|
Fix booking sync auth bypass
|
2026-06-01 23:03:47 +02:00 |
|
|
Jeppe B
|
d1871f1420
|
Fix SQL injection in vehicle plate order history lookup
|
2026-06-01 23:03:18 +02:00 |
|
|
Jeppe B
|
08a1538ed6
|
Merge pull request #212 from copenhagentruckwash/propose-fix-for-sql-injection-vulnerability
Cast pickup_bool to int to prevent SQL injection in bookings sync
|
2026-06-01 23:02:38 +02:00 |
|
|
Jeppe B
|
f2fc4f6f18
|
Fix SQL injection risk in booking sync pickup_bool
|
2026-06-01 23:02:28 +02:00 |
|
|
Jeppe B
|
503fd50c61
|
Merge pull request #211 from copenhagentruckwash/fix-vulnerability-in-wash-certificate-pdf-handling
Restore deletion of local wash certificate PDFs after upload
|
2026-06-01 23:02:12 +02:00 |
|
|
Jeppe B
|
1d6df82c1c
|
Delete local wash certificate PDFs after upload
|
2026-06-01 23:02:01 +02:00 |
|
|
Jeppe B
|
3fda0f9912
|
Merge pull request #210 from copenhagentruckwash/fix-auth-bypass-in-booking-sync-endpoint
Remove hardcoded auth_key bypass from /admin/bookings/sync
|
2026-06-01 23:01:37 +02:00 |
|
|
Jeppe B
|
decc571307
|
Fix booking sync auth bypass
|
2026-06-01 23:01:28 +02:00 |
|
|
Jeppe B
|
ef237b5e87
|
Merge pull request #206 from copenhagentruckwash/fix-sql-injection-in-vehicle-plate-history
Fix SQL injection in vehicle plate order history lookup
|
2026-06-01 22:59:14 +02:00 |
|
|
Jeppe B
|
828c177a57
|
Merge pull request #207 from copenhagentruckwash/fix-order-item-update-idor-vulnerability
Enforce tenant ownership check for PUT /order/items to prevent IDOR
|
2026-06-01 22:59:03 +02:00 |
|
|
copilot-swe-agent[bot]
|
c79219eb00
|
Merge remote-tracking branch 'origin/master' into fix-order-item-update-idor-vulnerability
# Conflicts:
# services/nginx/app/routes/orderItemsRoute.php
|
2026-06-01 20:58:04 +00:00 |
|
|
copilot-swe-agent[bot]
|
6995c3d1bc
|
Merge origin/master and resolve orders_o conflict
|
2026-06-01 20:57:44 +00:00 |
|
|
Jeppe B
|
7436584598
|
Merge pull request #209 from copenhagentruckwash/fix-unauthenticated-certificate-download-vulnerability
Require authentication token for wash certificate download endpoint
|
2026-06-01 22:57:33 +02:00 |
|
|
Jeppe B
|
06421beb6b
|
Require token for wash certificate downloads
|
2026-06-01 22:57:23 +02:00 |
|
|
Jeppe B
|
7de4b96074
|
Merge pull request #208 from copenhagentruckwash/fix-arbitrary-group_id-role-assignment
Harden role authorization on user creation
|
2026-06-01 22:56:08 +02:00 |
|
|
Jeppe B
|
ea69c64fad
|
Harden user creation role authorization
|
2026-06-01 22:55:57 +02:00 |
|
|
Jeppe B
|
652b89d23d
|
Fix IDOR in order item update route
|
2026-06-01 22:55:35 +02:00 |
|
|
Jeppe B
|
bc4b7bde15
|
Fix SQL injection in vehicle plate order history lookup
|
2026-06-01 22:55:06 +02:00 |
|
|
Jeppe B
|
a5b674286a
|
Merge pull request #205 from copenhagentruckwash/fix-order-update-vulnerability-for-invoice-collection
Validate invoice collection ownership when updating orders
|
2026-06-01 22:54:31 +02:00 |
|
|
copilot-swe-agent[bot]
|
18bf7aa013
|
Resolve merge conflict: combine invoice collection ownership validation with auto-reassign guard
|
2026-06-01 20:53:42 +00:00 |
|
|
Jeppe B
|
bf8262b64f
|
Validate invoice collection ownership when updating orders
|
2026-06-01 22:51:09 +02:00 |
|