kolaente 12dca5f0b0 fix(restore): reject zip entries with path traversal sequences ...

Validate all zip entry names during restore to reject entries
containing directory traversal sequences (e.g. ../../../pwned.txt).
This prevents a Zip Slip attack where a malicious archive could
write files outside the intended extraction directory.

2026-02-25 13:01:00 +01:00

..

caldav

fix(caldav): do not assume the first element is the VTODO component

2025-12-13 15:30:22 +01:00

cmd

feat(cli): reorganize repair commands under unified 'vikunja repair' parent (#2300)

2026-02-25 11:50:09 +00:00

config

refactor: remove typesense support

2026-02-25 12:15:28 +01:00

cron

fix: correct license header references (#882)

2025-06-10 12:18:38 +02:00

db

test: add orphaned project fixture for repair-projects command

2026-02-25 11:56:25 +01:00

doctor

refactor: remove typesense support

2026-02-25 12:15:28 +01:00

events

fix(events): only trigger task.updated once when marking task done

2025-11-16 11:01:15 +01:00

files

feat(cli): reorganize repair commands under unified 'vikunja repair' parent (#2300)

2026-02-25 11:50:09 +00:00

health

feat: introduce shared health check logic (#1073)

2025-07-02 21:01:41 +00:00

i18n

chore(i18n): update translations via Crowdin

2026-02-21 01:09:54 +00:00

initialize

refactor: remove typesense support

2026-02-25 12:15:28 +01:00

log

fix(log): write each log category to its own file (#2206)

2026-02-08 15:22:58 +00:00

mail

fix(mail): disable queue when mailer disabled (#2069)

2026-01-08 15:51:31 +01:00

metrics

fix: correct license header references (#882)

2025-06-10 12:18:38 +02:00

migration

refactor: remove typesense support

2026-02-25 12:15:28 +01:00

models

feat(cli): reorganize repair commands under unified 'vikunja repair' parent (#2300)

2026-02-25 11:50:09 +00:00

modules

fix(restore): reject zip entries with path traversal sequences

2026-02-25 13:01:00 +01:00

notifications

fix: isolate deletion notifications into per-user transactions

2026-02-25 11:03:02 +01:00

plugins

fix(deps): update module github.com/labstack/echo/v4 to v5 (#2131)

2026-01-24 20:38:32 +01:00

red

fix: correct license header references (#882)

2025-06-10 12:18:38 +02:00

routes

fix: address review comments on session lifecycle

2026-02-25 11:03:02 +01:00

swagger

[skip ci] Updated swagger docs

2026-02-25 09:39:04 +00:00

user

fix: address review comments on session lifecycle

2026-02-25 11:03:02 +01:00

utils

feat(doctor): add user namespace detection and improved storage diagnostics (#2180)

2026-02-01 11:57:35 +01:00

version

fix: correct license header references (#882)

2025-06-10 12:18:38 +02:00

web

fix(deps): update module github.com/labstack/echo/v4 to v5 (#2131)

2026-01-24 20:38:32 +01:00

webtests

test: add session lifecycle tests

2026-02-25 10:30:25 +01:00