changedetection.io

api

CVE-2026-27645 - Reflected XSS in RSS Single Watch request

2026-02-23 21:55:59 +01:00

blueprint

CVE-2026-27645 - Reflected XSS in RSS Single Watch request

2026-02-23 21:55:59 +01:00

browser_steps

Browser Steps - Clean off empty fields on save/update (UI and API), small refactor Re #3874 , #3879 (#3880 )

2026-02-16 13:05:46 +01:00

conditions

…

content_fetchers

CVE-2026-27696 - Server-Side Request Forgery (SSRF) via Watch URLs, set env var ALLOW_IANA_RESTRICTED_ADDRESSES to true to access IANA reserved URLs such as http://169.254.169.254 , http://10.0.0.1/, http://127.0.0.1/, etc.

2026-02-23 21:56:43 +01:00

diff

…

jinja2_custom

Memory improvement - Use builtin markupsafe instead of creating a jinja2 template env each time for small strings (#3836 )

2026-02-05 10:07:36 +01:00

model

Updates/migration - Re-run tag update, re-save to cleanup changedetection.json, code refactor (#3898 )

2026-02-18 14:05:23 +01:00

notification

…

processors

CVE-2026-27645 - Reflected XSS in RSS Single Watch request

2026-02-23 21:55:59 +01:00

realtime

Pip installs - remove flask patch and pin library versions

2026-02-21 13:41:16 +01:00

static

UI - Search modal - fixes for running in sub path

2026-02-18 10:27:12 +01:00

store

CVE-2026-27696 - Server-Side Request Forgery (SSRF) via Watch URLs, set env var ALLOW_IANA_RESTRICTED_ADDRESSES to true to access IANA reserved URLs such as http://169.254.169.254 , http://10.0.0.1/, http://127.0.0.1/, etc.

2026-02-23 21:56:43 +01:00

templates

Merge branch 'master' into diff-token-var-arg

2026-02-24 15:26:19 +01:00

tests

Merge branch 'master' into diff-token-var-arg

2026-02-24 15:26:19 +01:00

translations

CVE-2026-27645 - Reflected XSS in RSS Single Watch request

2026-02-23 21:55:59 +01:00

widgets

…

__init__.py

0.54.1

2026-02-23 23:01:31 +01:00

.gitignore

…

auth_decorator.py

…

custom_queue.py

…

favicon_utils.py

…

flask_app.py

CVE-2026-27645 - Reflected XSS in RSS Single Watch request

2026-02-23 21:55:59 +01:00

forms.py

Browser Steps - Clean off empty fields on save/update (UI and API), small refactor Re #3874 , #3879 (#3880 )

2026-02-16 13:05:46 +01:00

gc_cleanup.py

…

html_tools.py

Fixing bad replacement of metadata causing possible content removal #3906 (#3908 )

2026-02-20 00:55:37 +01:00

is_safe_url.py

…

languages.py

…

notification_service.py

Merge branch 'master' into diff-token-var-arg

2026-02-24 15:26:19 +01:00

pluggy_interface.py

Pluggy plugin hook for before and after a watch is processed (#3888 )

2026-02-17 01:58:41 +01:00

PLUGIN_README.md

…

pytest.ini

…

queue_handlers.py

…

queuedWatchMetaData.py

…

rss_tools.py

RSS Reader Mode parser improvements - Pick up all fields from RSS where possible, better auto-detect of the XML encoding if it wasnt set by the browser (#3646 )

2025-11-19 16:42:25 +01:00

run_basic_tests.sh

CVE-2026-27696 - Server-Side Request Forgery (SSRF) via Watch URLs, set env var ALLOW_IANA_RESTRICTED_ADDRESSES to true to access IANA reserved URLs such as http://169.254.169.254 , http://10.0.0.1/, http://127.0.0.1/, etc.

2026-02-23 21:56:43 +01:00

run_custom_browser_url_tests.sh

…

run_proxy_tests.sh

…

run_socks_proxy_tests.sh

…

strtobool.py

…

test_cli_opts.sh

…

time_handler.py

Fix time schedule off-by-one bug at exact end times for all durations and add comprehensive edge case tests Re #846 (#3890 )

2026-02-17 02:38:16 +01:00

validate_url.py

CVE-2026-27696 - Server-Side Request Forgery (SSRF) via Watch URLs, set env var ALLOW_IANA_RESTRICTED_ADDRESSES to true to access IANA reserved URLs such as http://169.254.169.254 , http://10.0.0.1/, http://127.0.0.1/, etc.

2026-02-23 21:56:43 +01:00

worker_pool.py

…

worker.py

Minor code tidy

2026-02-17 02:46:22 +01:00