dgtlmoon 5cc09d113b CSRF - Test fix

2026-08-20 14:49:53 +02:00

..

api

UI full refactor / upgrade (#4183)

2026-07-16 15:08:29 +02:00

blueprint

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

browser_steps

Browser Steps - Clean off empty fields on save/update (UI and API), small refactor Re #3874, #3879 (#3880)

2026-02-16 13:05:46 +01:00

conditions

i18n: Wrap untranslated UI strings and update ja translations (#4052)

2026-04-16 03:54:13 +02:00

content_fetchers

fix: Visual Selector renders scraped selectors as text, not markup (#4282)

2026-08-04 09:11:33 +02:00

diff

Fix - diff_changed_to causing some missed notifications #4063 #3818 (#4066)

2026-04-19 12:11:34 +02:00

jinja2_custom

…

llm

LLM - Counter stats - Fix LLM token counter race condition (#4276)

2026-07-30 10:56:05 +02:00

model

fix: invalidate favicon cache when clearing watch history (#4286)

2026-08-16 14:24:45 +02:00

notification

Security - SSRF in ChangeDetection.io via urlparse/urllib3 Parser Differential

2026-05-25 17:57:41 +02:00

processors

Security - GHSA-mh42-m7cg-49fr - Authenticated path traversal to arbitrary file write via the watch processor field (enum bypassed through /imports/import)

2026-08-20 10:56:13 +02:00

realtime

UI - Move rendering of each watchlist row out of the watchlist main template so it can be re-used by the realtime update (#4305)

2026-08-16 18:07:34 +02:00

static

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

store

Security - GHSA-mh42-m7cg-49fr - Authenticated path traversal to arbitrary file write via the watch processor field (enum bypassed through /imports/import)

2026-08-20 10:56:13 +02:00

templates

UI - Change 'Live' to 'Running' makes more sense

2026-08-16 18:32:45 +02:00

tests

CSRF - Test fix

2026-08-20 14:49:53 +02:00

translations

UI - Change 'Live' to 'Running' makes more sense

2026-08-16 18:32:45 +02:00

widgets

…

__init__.py

Security: hide the running version from anonymous visitors when a password is set (#2190) (#4306)

2026-08-20 11:09:13 +02:00

.gitignore

…

auth_decorator.py

Fixing GHSA-vwgh-2hvh-4xm5 — substring match in the shared_diff_access, improve access control to shared diff access (#4130)

2026-05-11 14:43:27 +02:00

custom_queue.py

…

favicon_utils.py

…

flask_app.py

Security: hide the running version from anonymous visitors when a password is set (#2190) (#4306)

2026-08-20 11:09:13 +02:00

forms.py

UI full refactor / upgrade (#4183)

2026-07-16 15:08:29 +02:00

gc_cleanup.py

…

html_tools.py

fix: sanitize lone unicode surrogates before filtering JSON (#4293)

2026-08-15 17:24:47 +02:00

is_safe_url.py

…

languages.py

UI full refactor / upgrade (#4183)

2026-07-16 15:08:29 +02:00

notification_service.py

UI full refactor / upgrade (#4183)

2026-07-16 15:08:29 +02:00

pluggy_interface.py

UI full refactor / upgrade (#4183)

2026-07-16 15:08:29 +02:00

PLUGIN_README.md

…

pytest.ini

…

queue_handlers.py

UI full refactor / upgrade (#4183)

2026-07-16 15:08:29 +02:00

queuedWatchMetaData.py

…

rss_tools.py

…

run_basic_tests.sh

CVE-2026-27696 - Server-Side Request Forgery (SSRF) via Watch URLs, set env var ALLOW_IANA_RESTRICTED_ADDRESSES to true to access IANA reserved URLs such as http://169.254.169.254, http://10.0.0.1/, http://127.0.0.1/, etc.

2026-02-23 21:56:43 +01:00

run_custom_browser_url_tests.sh

…

run_proxy_tests.sh

…

run_socks_proxy_tests.sh

…

strtobool.py

…

test_cli_opts.sh

…

time_handler.py

Fix time schedule off-by-one bug at exact end times for all durations and add comprehensive edge case tests Re #846 (#3890)

2026-02-17 02:38:16 +01:00

validate_url.py

fix: URL validation rejects valid URLs with '|' in the anchor/fragment (#4209) (#4243)

2026-07-06 19:27:59 +02:00

worker_pool.py

UI full refactor / upgrade (#4183)

2026-07-16 15:08:29 +02:00

worker.py

UI full refactor / upgrade (#4183)

2026-07-16 15:08:29 +02:00