kolaente 0515f2f0db fix(webhooks): bound the error response body read ...

The webhook target URL is user-configured, so a hostile target can answer
a delivery with a 4xx/5xx carrying an arbitrarily large body. That body
was read whole into memory and written whole to the log.

Cap the read at 4KiB, which is plenty for a diagnostic log line, matching
the LimitReader already used for the license server response.

2026-07-28 17:25:57 +02:00

..

admin_actions_test.go

feat: audit admin user and project mutations

2026-07-03 16:56:03 +00:00

admin_bypass_test.go

feat(permissions): site admins bypass all Can* checks (license-gated)

2026-04-20 18:55:06 +00:00

admin_bypass.go

feat(permissions): site admins bypass all Can* checks (license-gated)

2026-04-20 18:55:06 +00:00

admin_overview.go

feat(tasks): soft-delete tasks with permanent deletion after 30 days (#3119)

2026-07-07 11:38:33 +02:00

admin_project_list.go

feat: audit admin user and project mutations

2026-07-03 16:56:03 +00:00

admin_user_actions.go

feat: audit admin user and project mutations

2026-07-03 16:56:03 +00:00

admin_user_create.go

feat: audit admin user and project mutations

2026-07-03 16:56:03 +00:00

api_routes_test.go

fix: hide license-gated routes from api token scope list (#3216)

2026-07-18 10:00:37 +02:00

api_routes.go

fix(auth): reject API tokens at the OAuth authorize endpoint (GHSA-v3p6-34mc-hj7v)

2026-07-19 18:59:34 +02:00

api_tokens_expiry_cron_test.go

test: add tests for API token expiry notifications and cron

2026-03-30 12:28:15 +00:00

api_tokens_expiry_cron.go

test: add tests for API token expiry notifications and cron

2026-03-30 12:28:15 +00:00

api_tokens_expiry_notification_test.go

test: add tests for API token expiry notifications and cron

2026-03-30 12:28:15 +00:00

api_tokens_expiry_notification.go

feat: add Atom feed for user notifications with API token auth (#2758)

2026-05-15 17:25:09 +02:00

api_tokens_permissions.go

fix(api): derive API-token ownership from a verified user principal (GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

api_tokens_test.go

fix(api tokens): guard GetTokenFromTokenString against short token strings

2026-07-28 06:59:04 +00:00

api_tokens.go

fix(api tokens): guard GetTokenFromTokenString against short token strings

2026-07-28 06:59:04 +00:00

bot_users_permissions.go

feat(models): add BotUser CRUD wrapper

2026-05-01 14:44:10 +00:00

bot_users_test.go

feat(models): add BotUser CRUD wrapper

2026-05-01 14:44:10 +00:00

bot_users.go

feat(api/v2): add bot user CRUD on /api/v2

2026-06-05 08:51:39 +00:00

bulk_task_test.go

…

bulk_task.go

docs(api/v2): tag bulk task fields for the v2 schema

2026-06-09 20:13:02 +00:00

comment_quotes_test.go

feat(comments): treat quoted comment authors as implicit mentions

2026-05-20 21:02:14 +00:00

comment_quotes.go

feat(comments): treat quoted comment authors as implicit mentions

2026-05-20 21:02:14 +00:00

error_test.go

test: assert I18nParams keys against en.json translation placeholders

2026-07-18 13:41:15 +00:00

error.go

fix: interpolate dynamic values into translated error toasts

2026-07-18 13:41:15 +00:00

events.go

feat: audit admin reads and denied admin access

2026-07-03 16:56:03 +00:00

export_test.go

fix(export): treat a missing export meta row as no export in the status

2026-06-17 18:39:38 +00:00

export.go

feat(tasks): soft-delete tasks with permanent deletion after 30 days (#3119)

2026-07-07 11:38:33 +02:00

favorites.go

…

kanban_permissions.go

…

kanban_task_bucket_test.go

fix(task): recurring tasks return to original bucket when no default is set (#2806)

2026-07-03 23:18:00 +02:00

kanban_task_bucket.go

fix(kanban): authorize body task_id when moving a task into a bucket (GHSA-5pg6-m483-7vrg)

2026-07-19 18:59:34 +02:00

kanban_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

kanban.go

fix(kanban): prevent cross-tenant bucket relocation via project_view_id mass-assignment (GHSA-569v-q83c-3j3g)

2026-07-19 18:59:34 +02:00

label_permissions.go

feat(tasks): soft-delete tasks with permanent deletion after 30 days (#3119)

2026-07-07 11:38:33 +02:00

label_task_permissions.go

…

label_task_test.go

fix(tasks): bump project and task updated times when task sub-entities change

2026-07-07 11:57:04 +00:00

label_task.go

fix(tasks): bump project and task updated times when task sub-entities change

2026-07-07 11:57:04 +00:00

label_test.go

feat(labels): let bot owners manage labels created by their bots

2026-06-09 11:40:04 +00:00

label.go

docs(api/v2): mark server-controlled label and user fields read-only

2026-05-31 15:27:44 +02:00

link_sharing_permissions.go

fix(link-sharing): resolve share read permission via project id so by-id reads work

2026-06-05 09:17:25 +00:00

link_sharing_test.go

fix(security): validate link share JWTs against DB on every request

2026-04-09 15:38:07 +00:00

link_sharing.go

fix: shadow embedded CRUDable Update method on LinkSharing

2026-07-24 12:28:45 +00:00

listeners_test.go

fix(notifications): deliver task deleted notifications again

2026-07-28 06:52:13 +00:00

listeners.go

fix(notifications): deliver task deleted notifications again

2026-07-28 06:52:13 +00:00

main_test.go

refactor: remove environment variable requirements for go test

2026-02-17 18:01:05 +01:00

mentions_test.go

test: add tests for conversational email system

2026-03-08 16:03:47 +01:00

mentions.go

feat: format user mentions with display names in email notifications (#1930)

2025-12-10 12:39:05 +01:00

message.go

feat(api/v2): upload user avatar via multipart

2026-06-02 11:55:25 +00:00

metrics_count_test.go

feat(tasks): soft-delete tasks with permanent deletion after 30 days (#3119)

2026-07-07 11:38:33 +02:00

models.go

test(time-tracking): cover the time_entries model

2026-06-08 13:54:09 +00:00

notifications_database.go

fix(notifications): refresh embedded users when reading notifications

2026-06-17 21:18:04 +00:00

notifications_refresh_test.go

fix(notifications): refresh embedded users when reading notifications

2026-06-17 21:18:04 +00:00

notifications_refresh.go

fix(notifications): log unexpected user refresh failures

2026-06-17 21:18:04 +00:00

notifications_test.go

feat: add Atom feed for user notifications with API token auth (#2758)

2026-05-15 17:25:09 +02:00

notifications.go

feat: add Atom feed for user notifications with API token auth (#2758)

2026-05-15 17:25:09 +02:00

oauth_codes.go

feat: add OAuth 2.0 authorization code model and migration

2026-03-27 23:05:04 +00:00

permissions.go

fix: use correct type for permission error

2026-06-29 17:18:05 +02:00

project_duplicate_test.go

feat(projects): make duplicating shares opt-in (#2932)

2026-06-19 10:15:58 +02:00

project_duplicate.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

project_json_test.go

test: guard parent_project_id in project responses

2026-07-26 09:39:41 +00:00

project_permissions_multiple_teams_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

project_permissions.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

project_repair_test.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

project_repair.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

project_team_permissions.go

feat(permissions): site admins bypass all Can* checks (license-gated)

2026-04-20 18:55:06 +00:00

project_team_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

project_team.go

fix(notifications): use full user so notifications show display name

2026-06-18 20:57:05 +00:00

project_test.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

project_users_permissions_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

project_users_permissions.go

feat(permissions): site admins bypass all Can* checks (license-gated)

2026-04-20 18:55:06 +00:00

project_users_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

project_users.go

fix(notifications): use full user so notifications show display name

2026-06-18 20:57:05 +00:00

project_view_permissions.go

fix(security): reject cross-project views in ProjectView Can{Delete,Update} (GHSA-gg93-x632-9ccv)

2026-07-19 18:59:34 +02:00

project_view.go

docs: fix @Success 200 -> 201 on 5 PUT/Create endpoints

2026-07-18 17:05:32 +00:00

project.go

fix: always serialize parent_project_id for pseudo-projects

2026-07-26 09:39:41 +00:00

reaction_permissions.go

…

reaction_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

reaction.go

fix(api): reject link shares on reaction and task-read endpoints (consistency; GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

saved_filter_positions_test.go

feat(tasks): soft-delete tasks with permanent deletion after 30 days (#3119)

2026-07-07 11:38:33 +02:00

saved_filters_permissions.go

…

saved_filters_test.go

…

saved_filters.go

fix: always serialize parent_project_id for pseudo-projects

2026-07-26 09:39:41 +00:00

sessions_permissions.go

feat: add Session model with CRUD, permissions, and cleanup cron

2026-02-25 10:30:25 +01:00

sessions.go

fix(security): hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)

2026-07-19 18:59:34 +02:00

setup_tests.go

test(time-tracking): cover the time_entries model

2026-06-08 13:54:09 +00:00

subscription_permissions.go

…

subscription_test.go

feat(tasks): soft-delete tasks with permanent deletion after 30 days (#3119)

2026-07-07 11:38:33 +02:00

subscription.go

fix(notifications): deliver task deleted notifications again

2026-07-28 06:52:13 +00:00

task_assignees_permissions.go

…

task_assignees_test.go

fix(notifications): use full user so notifications show display name

2026-06-18 20:57:05 +00:00

task_assignees.go

fix(notifications): use full user so notifications show display name

2026-06-18 20:57:05 +00:00

task_attachment_permissions.go

…

task_attachment_test.go

fix(files): derive file size from reader at creation boundary

2026-04-09 16:22:56 +00:00

task_attachment.go

fix(api): return 200 instead of 500 when listing attachments on a task with none

2026-07-01 12:42:32 +00:00

task_collection_filter_test.go

fix(filters): resolve relative and absolute date filters in UTC (#3181) 🤖🤖🤖 (#3229)

2026-07-19 13:31:21 +02:00

task_collection_filter.go

fix(filters): resolve relative and absolute date filters in UTC (#3181) 🤖🤖🤖 (#3229)

2026-07-19 13:31:21 +02:00

task_collection_sort_test.go

…

task_collection_sort.go

docs(search): describe the actual constant-score relevance semantics

2026-07-06 15:45:55 +00:00

task_collection_test.go

test(tasks): pin subtask root placement for fuzzy search and multi-parent scopes

2026-07-19 14:16:07 +00:00

task_collection.go

fix(kanban): pin link-share task collection view to the share's project (GHSA-rj9j-8772-4h6c)

2026-07-19 18:59:34 +02:00

task_comment_permissions.go

…

task_comments_test.go

refactor(events): pass context to DispatchPending directly

2026-06-12 08:56:08 +00:00

task_comments.go

docs(task-comments): trim comments to the non-obvious why

2026-06-03 19:57:26 +00:00

task_delete_cron_test.go

feat(caldav): implement RFC 6578 sync-collection REPORT to sync task deletions

2026-07-07 11:57:04 +00:00

task_delete_cron.go

feat(caldav): implement RFC 6578 sync-collection REPORT to sync task deletions

2026-07-07 11:57:04 +00:00

task_duplicate_test.go

feat: add task duplicate backend model and tests

2026-03-04 17:20:26 +01:00

task_duplicate.go

feat(api/v2): add task duplicate action (#2815)

2026-06-01 14:13:39 +02:00

task_overdue_reminder_test.go

feat: extend WebhookListener for user-level webhooks

2026-03-08 19:45:53 +01:00

task_overdue_reminder.go

feat: extend WebhookListener for user-level webhooks

2026-03-08 19:45:53 +01:00

task_position_test.go

fix(tasks): prevent position race conditions with atomic upserts and locking (#3098)

2026-07-03 19:58:39 +02:00

task_position.go

perf(tasks): index task_positions on (project_view_id, position)

2026-07-26 01:13:08 +00:00

task_relation_authz_test.go

fix: use recursive CTE in accessibleProjectIDsSubquery for inherited project permissions

2026-04-05 12:20:35 +00:00

task_relation_permissions.go

…

task_relation_test.go

…

task_relation.go

docs(api/v2): tag task relation fields for the v2 schema

2026-06-09 20:42:00 +00:00

task_reminder_test.go

feat: extend WebhookListener for user-level webhooks

2026-03-08 19:45:53 +01:00

task_reminder.go

feat(tasks): soft-delete tasks with permanent deletion after 30 days (#3119)

2026-07-07 11:38:33 +02:00

task_search_bench_test.go

refactor(tasks): drop in-memory task dedup, rely on unique index

2026-06-17 21:16:41 +00:00

task_search_test.go

chore(search): consolidate scoring comments and deduplicate test helpers

2026-07-06 15:45:55 +00:00

task_search.go

fix(search): mirror ParadeDB BM25 matching into the subtask parent search condition

2026-07-19 14:16:07 +00:00

task_unread_statuses.go

fix(api): reject link shares on reaction and task-read endpoints (consistency; GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

tasks_permissions.go

refactor(models): remove *Arr helper fields now handled by normalizer

2026-05-31 12:56:57 +00:00

tasks_test.go

feat(tasks): soft-delete tasks with permanent deletion after 30 days (#3119)

2026-07-07 11:38:33 +02:00

tasks.go

fix(api): reject link shares on reaction and task-read endpoints (consistency; GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

team_members_permissions.go

feat(permissions): site admins bypass all Can* checks (license-gated)

2026-04-20 18:55:06 +00:00

team_members_test.go

…

team_members.go

fix(notifications): use full user so notifications show display name

2026-06-18 20:57:05 +00:00

team_sync.go

…

teams_permissions_test.go

…

teams_permissions.go

feat(permissions): site admins bypass all Can* checks (license-gated)

2026-04-20 18:55:06 +00:00

teams_test.go

…

teams.go

fix(notifications): use full user so notifications show display name

2026-06-18 20:57:05 +00:00

time_tracking_filter.go

feat(tasks): soft-delete tasks with permanent deletion after 30 days (#3119)

2026-07-07 11:38:33 +02:00

time_tracking_test.go

refactor(events): pass context to DispatchPending directly

2026-06-12 08:56:08 +00:00

time_tracking.go

fix(time-tracking): reject inverted time-entry intervals

2026-06-08 13:54:09 +00:00

unsplash.go

…

user_delete_test.go

fix(models): allow user-delete cascade to complete for disabled creators

2026-05-06 16:08:16 +02:00

user_delete.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

user_list_test.go

feat(user): always include own bots in user search

2026-05-01 14:44:10 +00:00

user_project_test.go

…

user_project.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

user_settings.go

feat(pro): admin password reset for existing users (#3085)

2026-07-02 19:39:00 +02:00

users.go

fix(notifications): use full user so notifications show display name

2026-06-18 20:57:05 +00:00

webhooks_permissions.go

feat: add user_id to webhooks and user-directed event infrastructure

2026-03-08 19:45:53 +01:00

webhooks_test.go

fix(webhooks): bound the error response body read

2026-07-28 17:25:57 +02:00

webhooks.go

fix(webhooks): bound the error response body read

2026-07-28 17:25:57 +02:00