23 Commits

Include renames

Author	SHA1	Message	Date
jamesread	0b2a5995ff	chore: coderabbit knows better than me	2026-07-29 01:25:44 +01:00
jamesread	e5d29b68da	fix: close shellAfterCompleted output injection bypass, and docs consistency ... Rewrite all output/exitCode template forms to env refs and omit them from template args so command output cannot reach sh -c. (GHSA-vc6p)	2026-07-28 16:57:52 +01:00
jamesread	839d244e51	fix: intermediate output and comfirmation	2026-07-27 23:17:42 +01:00
jamesread	18903853fb	fix: A single entities read failure wont clear all entities	2026-07-25 22:20:52 +01:00
jamesreadandCursor	c4531b344e	fix(executor): sanitize unsafe chars in log filenames ... Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-24 07:12:03 +01:00
jamesread	8eda67a39e	fix(docs): correct shellAfterCompleted quoting for output and exitCode ... The after-completion example put {{ output }} and {{ exitCode }} inside single-quoted shell arguments, so and never expanded after substituteShellAfterCompletedEnvRefs runs. Update the apprise sample to use printf-based quoting that allows env substitution, document the single-quote pitfall, and extend TestShellAfterCompletedUsesOutputEnvSafely to assert stdout is substituted as well as injection being blocked.	2026-07-08 14:01:43 +01:00
jamesreadandCursor	4ef86abee7	security: GHSA-vc6p-m6vx-6cwq (HIGH) harden shellAfterCompleted execution ... Route output and exitCode through OUTPUT/EXITCODE environment variables instead of shell interpolation, and block shellAfterCompleted for webhook actions. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-08 12:29:37 +01:00
jamesread	03d188337e	fix: Parse templates in action (#1035)	2026-06-20 00:26:13 +01:00
jamesread	ebffd9f040	security: GHSA-prj9-97mp-mwh2 (HIGH) Treat all ot_ system arguments as reserved, preventing RCE ... Ensure OliveTin-owned arguments are injected only after filtering and validate system values before command execution.	2026-05-31 22:44:40 +01:00
jamesread	9080577f2b	chore: potential crash in unit tests	2026-03-05 08:10:56 +00:00
jamesread	00cb5a2abf	fix: action triggers were broken #914	2026-03-04 23:12:20 +00:00
jamesread	38d6b57077	chore: codefmt	2026-02-25 23:24:02 +00:00
jamesread	4bbd2eab15	security: GHSA-49gm-hh7w-wfvf	2026-02-22 10:19:08 +00:00
jamesread	b777d599aa	fix: Massive cleanup of template parsing	2026-02-07 00:09:46 +00:00
jamesread	be7c754043	feat: Rebuild authentication system to support 3k authentication	2025-11-26 22:33:19 +00:00
jamesread	a464e6a445	fix: broken tests after changing the way arguments are parsed	2025-10-01 22:20:56 +01:00
jamesread	570c0ba087	chore: Repair output streaming, lots of css/go lint	2025-09-06 08:42:13 +01:00
James Read	e38361f3d7	fix: gofmt/gocylo leftover from old PR (#610)	2025-06-22 20:42:57 +00:00
James Read	18c5599704	fix: Datetime mangling for Android phones #564 (#602)	2025-06-06 20:41:54 +00:00
James Read	633e513697	feature: (#568) Separator allowed in usergroup line for trusted headers (#572)	2025-04-22 14:35:49 +01:00
James Read	eb2721c023	chore: Cleanup argument handling (#571)	2025-04-21 08:50:59 +00:00
James Read	88f639d29f	chore: Cleanup executor shell passing (#556)	2025-04-07 20:48:45 +00:00
James Read	ff31abe66c	refactor: Project directories (#541)	2025-03-22 01:06:59 +00:00