kolaente b36581bcc1 fix(routes): only bind JSON, form and multipart request bodies ...

Form and multipart only bind fields with an explicit form tag. Other
content types are answered with 415, or 400 (2004) on v1 CRUD routes.

2026-11-05 15:42:45 +01:00

..

api

fix(images): limit the side length of decoded images

2026-11-05 15:42:45 +01:00

caldav

fix(caldav): answer task validation errors with 403 instead of 500

2026-11-05 15:42:45 +01:00

feeds

fix(auth): refuse email-unconfirmed accounts on every credential path

2026-10-20 15:13:02 +02:00

middleware

refactor(utils): share rune-safe string truncation

2026-11-05 15:42:45 +01:00

admin_gate.go

…

api_tokens.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

binder.go

fix(routes): only bind JSON, form and multipart request bodies

2026-11-05 15:42:45 +01:00

change_password_test.go

feat: add /.well-known/change-password redirect

2026-09-15 14:12:54 +02:00

change_password.go

feat: add /.well-known/change-password redirect

2026-09-15 14:12:54 +02:00

error_handler_test.go

fix: unwrap wrapped domain errors in the http error handler

2026-09-05 12:17:45 +02:00

error_handler.go

fix(sentry): group reported errors by the error, not the reporting frame

2026-09-06 10:51:30 +02:00

feature_gate.go

…

healthcheck.go

feat: add basic auth config for health endpoints

2026-11-03 09:12:02 +01:00

ip_test.go

…

ip.go

…

json_serializer.go

fix(api): reject JSON bodies containing NUL on /api/v1

2026-11-02 11:58:07 +01:00

metrics.go

refactor(routes): extract config-driven basic auth from metrics

2026-11-03 09:12:02 +01:00

pprof_test.go

feat(metrics): optional Go profiler endpoint at /debug/pprof

2026-09-06 16:36:51 +02:00

rate_limit_test.go

fix(routes): send and expose Retry-After on rate-limited responses

2026-10-01 17:34:38 +02:00

rate_limit.go

fix(routes): log route template instead of raw request URI

2026-10-20 15:13:02 +02:00

request_logger_test.go

fix(routes): log the path of served frontend assets

2026-10-21 19:46:35 +02:00

resolve_project.go

…

routes.go

fix(routes): only bind JSON, form and multipart request bodies

2026-11-05 15:42:45 +01:00

sentry_middleware.go

…

static_test.go

refactor(client): delete shared legacy infrastructure and Axios

2026-09-30 10:42:35 +02:00

static.go

fix(routes): log the path of served frontend assets

2026-10-21 19:46:35 +02:00

validation.go

…