kolaente 8d9bc3e65e feat(webhooks): add built-in SSRF protection using daenney/ssrf ...

Block webhook requests to non-globally-routable IP addresses by default.
Uses net.Dialer.Control hook to validate resolved IPs against IANA
Special Purpose Registries after DNS resolution, preventing DNS rebinding.

Configurable via webhooks.allownonroutableips (default: false).

2026-03-19 15:18:06 +01:00

..

api_routes_test.go

test: add failing test for bulk label API token route registration

2026-03-10 23:58:44 +01:00

api_routes.go

fix: register bulk label route correctly for API token permissions

2026-03-10 23:58:44 +01:00

api_tokens_permissions.go

…

api_tokens_test.go

…

api_tokens.go

…

bulk_task_test.go

…

bulk_task.go

…

error.go

feat: add Session model with CRUD, permissions, and cleanup cron

2026-02-25 10:30:25 +01:00

events.go

feat: add user_id to webhooks and user-directed event infrastructure

2026-03-08 19:45:53 +01:00

export.go

fix: eliminate nested database sessions to prevent table locks

2026-02-25 11:03:02 +01:00

favorites.go

…

kanban_permissions.go

…

kanban_task_bucket_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

kanban_task_bucket.go

fix: prevent nil pointer panic in mention notification listeners

2026-03-04 10:29:16 +01:00

kanban_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

kanban.go

…

label_permissions.go

…

label_task_permissions.go

…

label_task_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

label_task.go

…

label_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

label.go

…

link_sharing_permissions.go

…

link_sharing_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

link_sharing.go

fix(auth): use checked type assertions for all JWT claims

2026-02-25 13:01:00 +01:00

listeners.go

feat: add user_id to webhooks and user-directed event infrastructure

2026-03-08 19:45:53 +01:00

main_test.go

refactor: remove environment variable requirements for go test

2026-02-17 18:01:05 +01:00

mentions_test.go

test: add tests for conversational email system

2026-03-08 16:03:47 +01:00

mentions.go

…

message.go

…

models.go

feat: register Vikunja tables with db package at init

2026-03-04 15:37:54 +01:00

notifications_database.go

…

notifications_test.go

…

notifications.go

feat: add user_id to webhooks and user-directed event infrastructure

2026-03-08 19:45:53 +01:00

permissions.go

…

project_duplicate_test.go

…

project_duplicate.go

fix: use session-aware file creation to avoid nested transactions

2026-02-25 11:03:02 +01:00

project_permissions_multiple_teams_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

project_permissions.go

…

project_repair_test.go

feat: add repair-projects CLI command

2026-02-25 11:56:25 +01:00

project_repair.go

feat: add repair-projects CLI command

2026-02-25 11:56:25 +01:00

project_team_permissions.go

…

project_team_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

project_team.go

fix(events): defer event dispatch for project operations

2026-03-03 12:46:34 +01:00

project_test.go

test: add result count assertions for ParadeDB search tests

2026-03-05 13:57:05 +01:00

project_users_permissions_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

project_users_permissions.go

…

project_users_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

project_users.go

fix(events): defer event dispatch for project operations

2026-03-03 12:46:34 +01:00

project_view_permissions.go

…

project_view.go

fix(views): assign default position when creating new project views

2026-03-02 08:35:35 +01:00

project.go

fix(events): defer event dispatch for project operations

2026-03-03 12:46:34 +01:00

reaction_permissions.go

…

reaction_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

reaction.go

…

saved_filter_positions_test.go

…

saved_filters_permissions.go

…

saved_filters_test.go

…

saved_filters.go

refactor: remove typesense support

2026-02-25 12:15:28 +01:00

sessions_permissions.go

feat: add Session model with CRUD, permissions, and cleanup cron

2026-02-25 10:30:25 +01:00

sessions.go

fix: commit transaction in session cleanup cron

2026-02-25 11:03:02 +01:00

setup_tests.go

feat: add user_id to webhooks and user-directed event infrastructure

2026-03-08 19:45:53 +01:00

subscription_permissions.go

…

subscription_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

subscription.go

…

task_assignees_permissions.go

…

task_assignees.go

fix(events): defer event dispatch for task sub-entities

2026-03-03 12:46:34 +01:00

task_attachment_permissions.go

…

task_attachment_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

task_attachment.go

fix(events): defer event dispatch for task sub-entities

2026-03-03 12:46:34 +01:00

task_collection_filter_test.go

fix(filter): recover from datemath panic on malformed date filter values

2026-02-26 16:09:13 +01:00

task_collection_filter.go

fix(filter): recover from datemath panic on malformed date filter values

2026-02-26 16:09:13 +01:00

task_collection_sort_test.go

…

task_collection_sort.go

…

task_collection_test.go

test: add result count assertions for ParadeDB search tests

2026-03-05 13:57:05 +01:00

task_collection.go

fix(tasks): support both expand and expand[] query parameter formats (#2415)

2026-03-19 09:18:11 +00:00

task_comment_permissions.go

…

task_comments_test.go

test: update event assertions to work with deferred dispatch

2026-03-03 12:46:34 +01:00

task_comments.go

fix(events): defer event dispatch for task sub-entities

2026-03-03 12:46:34 +01:00

task_duplicate_test.go

feat: add task duplicate backend model and tests

2026-03-04 17:20:26 +01:00

task_duplicate.go

fix: preserve cover image when duplicating task

2026-03-04 17:20:26 +01:00

task_overdue_reminder_test.go

feat: extend WebhookListener for user-level webhooks

2026-03-08 19:45:53 +01:00

task_overdue_reminder.go

feat: extend WebhookListener for user-level webhooks

2026-03-08 19:45:53 +01:00

task_position_test.go

…

task_position.go

fix(events): defer event dispatch for user creation and task positions

2026-03-03 12:46:34 +01:00

task_relation_permissions.go

…

task_relation_test.go

…

task_relation.go

fix(events): defer event dispatch for task sub-entities

2026-03-03 12:46:34 +01:00

task_reminder_test.go

feat: extend WebhookListener for user-level webhooks

2026-03-08 19:45:53 +01:00

task_reminder.go

feat: extend WebhookListener for user-level webhooks

2026-03-08 19:45:53 +01:00

task_search_bench_test.go

refactor: remove typesense support

2026-02-25 12:15:28 +01:00

task_search_test.go

…

task_search.go

refactor: remove typesense support

2026-02-25 12:15:28 +01:00

task_unread_statuses.go

…

tasks_permissions.go

fix(tasks): support both expand and expand[] query parameter formats (#2415)

2026-03-19 09:18:11 +00:00

tasks_test.go

test: add task #48 to expected results in feature tests

2026-03-05 13:57:05 +01:00

tasks.go

fix(tasks): support both expand and expand[] query parameter formats (#2415)

2026-03-19 09:18:11 +00:00

team_members_permissions.go

…

team_members_test.go

…

team_members.go

fix(events): defer event dispatch for team operations

2026-03-03 12:46:34 +01:00

team_sync.go

…

teams_permissions_test.go

…

teams_permissions.go

…

teams_test.go

…

teams.go

fix(events): defer event dispatch for team operations

2026-03-03 12:46:34 +01:00

unsplash.go

…

user_delete_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

user_delete.go

fix: send account deletion notification before deleting user row

2026-03-10 23:44:53 +01:00

user_list_test.go

refactor: move ListUsers tests from pkg/user to pkg/models

2026-03-04 20:32:11 +01:00

user_project_test.go

…

user_project.go

…

users.go

…

webhooks_permissions.go

feat: add user_id to webhooks and user-directed event infrastructure

2026-03-08 19:45:53 +01:00

webhooks_ssrf_test.go

test(webhooks): add SSRF protection tests

2026-03-19 15:18:06 +01:00

webhooks.go

feat(webhooks): add built-in SSRF protection using daenney/ssrf

2026-03-19 15:18:06 +01:00