kolaente 0515f2f0db fix(webhooks): bound the error response body read ...

The webhook target URL is user-configured, so a hostile target can answer
a delivery with a 4xx/5xx carrying an arbitrarily large body. That body
was read whole into memory and written whole to the log.

Cap the read at 4KiB, which is plenty for a diagnostic log line, matching
the LimitReader already used for the license server response.

2026-07-28 17:25:57 +02:00

..

audit

feat: audit admin reads and denied admin access

2026-07-03 16:56:03 +00:00

caldav

fix(caldav): compute VTODO DURATION components correctly (#3155)

2026-07-11 17:28:59 +02:00

caldavtests

…

cmd

fix(cli): drain the mail queue before user commands exit

2026-07-09 17:05:21 +00:00

config

fix(config): apply deprecated service.jwtsecret to service.secret

2026-07-26 15:59:40 +00:00

cron

…

db

fix(db): ping the database on connect so failures report the real error

2026-07-26 15:40:29 +02:00

doctor

…

e2etests

…

events

…

files

fix: GCS signing issue (#2920)

2026-07-02 17:38:37 +02:00

health

…

i18n

chore(i18n): update translations via Crowdin

2026-07-25 00:24:11 +00:00

initialize

feat(auth): add OpenID provider availability monitoring and retry logic (#3145)

2026-07-10 17:52:01 +02:00

license

…

log

…

mail

fix(cli): drain the mail queue before user commands exit

2026-07-09 17:05:21 +00:00

metrics

feat(tasks): soft-delete tasks with permanent deletion after 30 days (#3119)

2026-07-07 11:38:33 +02:00

migration

ci(lint): forbid plain Sync in migrations via forbidigo

2026-07-26 13:42:33 +00:00

models

fix(webhooks): bound the error response body read

2026-07-28 17:25:57 +02:00

modules

fix(oauth2): burn authorization code even when validation fails (#3350)

2026-07-28 17:13:15 +02:00

notifications

fix(notifications): render Markdown in plain-text emails (#3219)

2026-07-18 14:39:32 +02:00

plugins

…

red

…

richtext

…

routes

fix(auth): gate the v2 login route on local or ldap auth being enabled

2026-07-28 17:25:37 +02:00

swagger

docs: fix @Success 200 -> 201 on 5 PUT/Create endpoints

2026-07-18 17:05:32 +00:00

user

fix(auth): use configured bcrypt rounds everywhere

2026-07-28 08:43:26 +02:00

utils

fix(security): hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)

2026-07-19 18:59:34 +02:00

version

…

web

fix: interpolate dynamic values into translated error toasts

2026-07-18 13:41:15 +00:00

websocket

…

webtests

fix(auth): gate the v2 login route on local or ldap auth being enabled

2026-07-28 17:25:37 +02:00

yaegi_symbols

…