mirror of
https://github.com/FOSSBilling/FOSSBilling.git
synced 2026-11-09 13:36:07 +09:00
0d81f5d450
* Sanitise email HTML; add session decoder * Use signed session restore token for redirects * Restrict invoice and service access to client * Perform CSRF check regardless of session * Validate uploaded files by extension/mime * Use 32-byte random for reset hashes * Use PBKDF2 SHA-256 for key derivation * Add versioned encryption and migrate data * Refactor Servicecustom API and update download validation * Prefer token login when credentials present * Update cspell word list with filetype terms * Ignore token auth for guest requests * Validate decrypted text and add fixed IV in test * Bump `last_patch` setting to 50 * Update src/modules/Api/Controller/Client.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix CSRF/token auth interaction: token auth always bypasses CSRF regardless of session (#3318) * Replace hand-rolled PHP session parser with unserialize() (#3317) * Initial plan * Replace buggy phpSessionDecode() with unserialize() Co-authored-by: admdly <2807620+admdly@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: admdly <2807620+admdly@users.noreply.github.com> Co-authored-by: Adam Daley <admdly@users.noreply.github.com> * Fix migrateEncryptedColumn failing on tables without updated_at (#3316) * Initial plan * Fix migrateEncryptedColumn to skip updated_at when column doesn't exist Co-authored-by: admdly <2807620+admdly@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: admdly <2807620+admdly@users.noreply.github.com> Co-authored-by: Adam Daley <admdly@users.noreply.github.com> * Guard `phpSessionDecode()` return type in `deleteSessionIfMatching` (#3319) * Initial plan * Guard phpSessionDecode() return type in deleteSessionIfMatching Co-authored-by: admdly <2807620+admdly@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: admdly <2807620+admdly@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: admdly <2807620+admdly@users.noreply.github.com>