Commits

8aeda89

update

2026-07-10T21:19:25+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

4ad82bc

Fix F5-1: remove shebang causing fatal error on PHP-FPM (ai_cron, recurring_processor)

2026-07-10T21:19:20+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

d9c6d39

update

2026-07-10T21:16:23+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

af4ef1a

Update deploy hash

2026-07-10T21:16:04+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

240a480

update

2026-07-10T21:11:03+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

4a069f0

Keep AI system prompts in trusted provider role

2026-07-10T21:10:58+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

cf7e877

update

2026-07-10T21:06:34+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

6a7e5b3

Repair legacy rate limit schema safely

2026-07-10T21:06:28+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

f106b49

update

2026-07-10T21:02:47+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

ea63a31

Reduce web locale payload and fix CLI strict types

2026-07-10T21:02:41+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 50 | core 0 | module 0 | forbidden 0

Flags:

11d3715

Add unit tests for AuthService::me() absolute session TTL (F1-4)

2026-07-10T20:55:54+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

f00e289

update

2026-07-10T20:54:03+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

9ecc236

update

2026-07-10T20:46:01+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

9ee3d19

Fix F1-4: add absolute session max lifetime (30d) to prevent infinite sliding TTL

2026-07-10T20:45:41+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 8 | core 0 | module 0 | forbidden 0

Flags:

c87b34a

update

2026-07-10T20:23:11+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

27262b0

Fix F4-3 (prompt injection: nonce-based delimiter + expanded whitelist) and F4-5 (restrict crm_list_api_endpoints to admin)

2026-07-10T20:23:02+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

26873f2

update

2026-07-10T20:10:27+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

19a49a3

Fix F5-1 (fail-fast secrets in production) and F5-2 (storage dir permissions)

2026-07-10T20:10:08+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

a5ed705

update

2026-07-10T18:49:29+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

a57ecfa

Fix remaining LOW/MEDIUM audit findings: F2-5 (error_log), F1-2 (login+IP rate key), F1-1 (fail-closed + no DROP TABLE), F4-2 (MCP secrets), F3-3 (quarantine html), F5-1 (CLI guards)

2026-07-10T18:49:10+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 58 | core 0 | module 0 | forbidden 0

Flags:

5a7d321

Fix remaining HIGH/MEDIUM audit findings: F2-2 (hierarchy fix), F3-2 (IPv6 SSRF), F5-1 (htaccess), F4-1 (MCP errors), F4-4 (batch limit), F3-1 (zip-slip), F2-1 (user create hierarchy)

2026-07-10T18:41:55+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 12 | core 0 | module 0 | forbidden 0

Flags:

c5311e0

update

2026-07-10T18:10:22+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

0891d3b

Fix regression: revert getSettingValue to prepared statement

2026-07-10T18:10:12+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

75008cc

update

2026-07-10T18:07:48+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

7c7dfed

Fix Phase 2-3 audit findings: F3-01 SSRF in callWebhookAsync, F3-02 Module install path traversal, F3-03 raw SQL in IdeaController, F2-01 ai.admin bypass, F3-04 ALTER TABLE column whitelist

2026-07-10T18:06:57+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 10 | core 0 | module 0 | forbidden 0

Flags:

527ea34

update

2026-07-10T17:07:57+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 12 | core 0 | module 0 | forbidden 0

Flags:

24cf7b7

update

2026-07-10T16:55:01+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

0741383

update

2026-07-10T16:53:06+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

e68597e

Fix per-login brute force: replace broken DatabaseRateLimiter with file-based rate limiter (shared fileRateLimit engine). Remove dead rate limiter deps from AuthService constructor and app.php factory

2026-07-10T16:53:05+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

97573ac

update

2026-07-10T16:42:34+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

3b8f82d

update

2026-07-10T16:35:20+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

24753a4

Add explicit assertParticipant() to all write methods in ChatController (sendMessage, editMessage, deleteMessage, uploadAttachment, markRead, settings, archive, restore) for defence-in-depth. Fix restore() to use chatForCurrentUser instead of raw SQL

2026-07-10T16:34:30+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

67f5a86

Add required_permissions to idea (idea.view/idea.manage) and chat (chat.use) routes

2026-07-10T16:27:16+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

60b2bbc

Fix IDOR in IdeaController::updateStatus() — add author_user_id/is_root check before status change

2026-07-10T16:21:54+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

c8b5c94

update

2026-07-10T16:13:40+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 8 | core 0 | module 0 | forbidden 0

Flags:

95ba790

update

2026-07-10T16:09:55+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

9cbe167

SEC-03: log plain password reset token to storage/logs/mail.log for dev/demo

2026-07-10T16:08:40+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

1241996

update

2026-07-10T16:04:13+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

f4d1c00

update

2026-07-10T16:03:53+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

0ba79da

SEC-02: add index on updated_at for efficient garbage collection in rate_limits

2026-07-10T16:03:52+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 4 | core 0 | module 0 | forbidden 0

Flags:

d1e4b0b

update

2026-07-10T16:01:15+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

24e7107

SEC-01: replace DB-based IP rate limiter with file-based implementation (flock) for reliable password spraying prevention

2026-07-10T16:00:28+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

816c09b

update

2026-07-10T15:55:55+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

a60ae26

Fix: add key column to SELECT verify query for completeness

2026-07-10T15:55:22+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

e6437d4

Fix: replace SHOW COLUMNS+ALTER TABLE in ensureNewColumns with reliable SELECT LIMIT 0 approach; remove debug logging

2026-07-10T15:54:13+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

32d6884

update

2026-07-10T15:51:17+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

35fd0e0

debug: add RL_DEBUG logging to DatabaseRateLimiter

2026-07-10T15:50:56+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

4f968ae

update

2026-07-10T15:47:52+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags:

38b9090

update

2026-07-10T15:42:22+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 6 | core 0 | module 0 | forbidden 0

Flags:

6755435

update

2026-07-10T15:35:57+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files: 2 | core 0 | module 0 | forbidden 0

Flags: