 James Smith
|
339321cc14
|
Don't set session cookies on indexed asset requests
In order to avoid session leakage via caches.
|
2026-02-19 15:13:12 +00:00 |
|
|
James Smith
|
4a90fc3927
|
improve count efficiency with empty?
|
2026-02-06 10:02:10 +00:00 |
|
|
James Smith
|
7ff6dc06b2
|
Improve a few user checks to avoid errors
|
2026-02-05 15:30:43 +00:00 |
|
|
James Smith
|
20f2bc3663
|
refactor user matching into user object itself
|
2026-01-16 16:54:39 +00:00 |
|
|
James Smith
|
7736229a61
|
Add users to permission lists and groups by fediverse address
|
2026-01-16 13:27:50 +00:00 |
|
|
James Smith
|
0aba2f2957
|
Remove adding users to groups by ID, to avoid enumeration
This was only ever a temporary capability until we had email.
|
2026-01-16 11:25:36 +00:00 |
|
|
James Smith
|
4a5d49c141
|
Allow matching users by email when adding to group
|
2026-01-15 15:02:22 +00:00 |
|
|
James Smith
|
3d4de3a828
|
refactor user matching for groups into applicationcontroller method
|
2026-01-15 15:01:26 +00:00 |
|
|
James Smith
|
28999232c1
|
Change signed download URLs to end with original filename
|
2025-11-17 21:46:51 +00:00 |
|
|
James Smith
|
8ed4a3ee7d
|
move order preference setting into concern
|
2025-11-05 09:38:10 +00:00 |
|
|
James Smith
|
05a35ca2e6
|
DRY up first use check
|
2025-10-28 11:23:46 +00:00 |
|
|
James Smith
|
bdae511a72
|
lint: Add blank lines after includes
|
2025-10-17 12:06:22 +01:00 |
|
|
James Smith
|
713075eb96
|
make send_file_content usable elsewhere
|
2025-09-23 13:11:23 +01:00 |
|
|
James Smith
|
4fd31ad846
|
don't switch locales if we're not using an HTML format
|
2025-09-11 17:35:22 +01:00 |
|
|
James Smith
|
9f94db8e88
|
skip pundit checks for fasp_client controllers
|
2025-08-11 09:46:05 +01:00 |
|
|
James Smith
|
80f1c793bb
|
remove activeadmin route, models, and initializer
|
2025-08-01 15:04:54 +01:00 |
|
|
James Smith
|
cd12b0abea
|
add method for setting indexable meta tag and header
|
2025-06-20 13:21:08 +01:00 |
|
|
James Smith
|
203b65e60b
|
Fix error when entering an invalid site logo URL
|
2025-06-11 11:50:35 +01:00 |
|
|
James Smith
|
256add6082
|
allow frames and images from any https source if federation is enabled
|
2025-06-03 15:12:28 +01:00 |
|
|
James Smith
|
f6997d1826
|
Display error if search syntax was bad
|
2025-05-18 22:54:09 +01:00 |
|
|
James Smith
|
59753d0fc0
|
Adjust CSP to allow the turbo progress bar to be displayed
|
2025-05-09 17:26:59 +01:00 |
|
|
James Smith
|
885253cf3f
|
Remove no longer needed allow_api_access method
|
2025-05-02 15:55:40 +01:00 |
|
|
James Smith
|
4507076d02
|
don't use session for API requests
|
2025-05-01 16:31:28 +01:00 |
|
|
James Smith
|
51d7c8dd40
|
automatically check scopes in warden strategy
|
2025-05-01 11:08:00 +01:00 |
|
|
James Smith
|
a17e6e779a
|
move 401 error into warden strategy
|
2025-04-25 23:42:35 +01:00 |
|
|
James Smith
|
16e824ad75
|
Move doorkeeper authentication into Warden strategy
|
2025-04-25 17:35:40 +01:00 |
|
|
Manuel Tancoigne
|
3c64cebbf7
|
---FIXME Disable CSP in test environment
|
2025-04-12 10:37:41 +02:00 |
|
|
Manuel Tancoigne
|
3afae7c4ca
|
Fix typo
|
2025-04-12 10:27:31 +02:00 |
|
|
James Smith
|
b7bfcef53a
|
skip CSRF protection on API requests
|
2025-04-11 12:54:44 +01:00 |
|
|
James Smith
|
71349674de
|
Change API to use vendor-specific content type, including version
|
2025-04-11 12:14:28 +01:00 |
|
|
James Smith
|
c07541ce4d
|
Support public scope, where there is no authenticated resource owner
|
2025-04-10 13:48:21 +01:00 |
|
|
James Smith
|
9196e9aa18
|
refactor API auth to allow per-action setting of scope
|
2025-04-10 13:31:07 +01:00 |
|
|
James Smith
|
dbc0735bd6
|
check for read scope on API requests
|
2025-04-10 12:34:10 +01:00 |
|
|
James Smith
|
8a87f56c10
|
authenticate app owner with token
|
2025-04-08 16:27:29 +01:00 |
|
|
TheMBeat
|
77ecc6c4f8
|
Fix lint error
|
2025-04-03 07:09:43 +00:00 |
|
|
TheMBeat
|
df69920be1
|
allowed CORS image
|
2025-04-03 08:33:10 +02:00 |
|
|
James Smith
|
6590ae436d
|
Make site name, tagline and icon editable in settings
|
2025-03-26 22:57:21 +00:00 |
|
|
James Smith
|
b9503b5c92
|
Add icons to "open in slicer" menu options
|
2025-03-21 12:10:08 +00:00 |
|
|
James Smith
|
8fcead6e73
|
don't run user auth in single user mode if a signed ID is being used
|
2025-03-19 22:02:53 +00:00 |
|
|
James Smith
|
4d30a74abd
|
add method to detect if a signed ID is being used
|
2025-03-19 22:02:29 +00:00 |
|
|
James Smith
|
b8c128a2be
|
add rubocop-pundit checks for use of #all
|
2025-02-27 16:49:48 +00:00 |
|
|
James Smith
|
536cd2f96c
|
disable UsePolicyScope for first-use checks
|
2025-02-27 10:19:46 +00:00 |
|
|
James Smith
|
c5f83a9d13
|
allow google fonts to be used
|
2025-02-13 10:52:20 +00:00 |
|
|
James Smith
|
0245c084fa
|
add SUDO_RUN_UNSAFELY env var to disable root security warning
Useful for running on PaaS systems where root is OK.
Resolves #3067
|
2025-01-22 01:03:31 +00:00 |
|
|
James Smith
|
23e7cc5244
|
fix potential error with empty locale setting
|
2024-11-15 09:26:16 +00:00 |
|
|
James Smith
|
8c9d387851
|
Allow customisation of site name, tagline and logo
|
2024-10-16 10:44:59 +01:00 |
|
|
James Smith
|
8b36ec7c4b
|
show documents and videos in model file lists and views
|
2024-10-08 22:42:35 +01:00 |
|
|
James Smith
|
bab0d6111f
|
don't handle pundit errors in test, so we can check them
|
2024-09-17 17:18:28 +01:00 |
|
|
James Smith
|
f3add57813
|
redirect to login if authorisation fails
resolves #2695
|
2024-09-17 16:58:08 +01:00 |
|
|
James Smith
|
60d3f1b69e
|
restore autologin in single user mode
|
2024-09-05 15:31:47 +01:00 |
|