vignesh/trypost
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
trypost/app/Http/Controllers/App
History
Paulo Castellano 4a08913d70 fix(security): make SSRF private-network block configurable and guard the last user-URL fetches 
Add config('trypost.security.allow_private_network') (env TRYPOST_ALLOW_PRIVATE_NETWORK, default off) so self-hosted operators can reach their own internal network; only the private-IP rejection is bypassed, scheme/host checks always apply. Add SafeHttpFetcher::guardedRequest() and route the last unguarded user-supplied-URL fetches through it: the Unsplash/Giphy asset import, the API/MCP attach-media-from-URL download, and the OAuth avatar download. Our-own-storage reads (media crop, Bluesky media) are intentionally left unguarded so internal storage keeps working when self-hosted.
2026-07-17 15:40:15 -03:00
..
Settings chore(settings): drop the language-changed flash banner 2026-06-22 12:32:11 -03:00
AnalyticsController.php fix(permissions): enforce workspace roles across backend and UI 2026-06-22 16:31:54 -03:00
ApiKeyController.php feat: migrate custom API token implementation to Laravel Passport for authentication and token management 2026-05-03 18:38:17 -03:00
AssetController.php fix(security): make SSRF private-network block configurable and guard the last user-URL fetches 2026-07-17 15:40:15 -03:00
AutomationController.php fix(permissions): enforce workspace roles across backend and UI 2026-06-22 16:31:54 -03:00
BillingController.php feat(billing): attach persona to conversion tracking and polish annual banner 2026-06-22 12:32:03 -03:00
Controller.php refactor: restructure to Actions, subdomain routes (app/api), API tokens 2026-03-29 19:24:28 -03:00
DiscordController.php feat(channels): add Discord as a social channel 2026-06-16 14:44:00 -03:00
GiphyController.php feat: complete AI assistant with custom services and brand config 2026-04-16 09:25:08 -03:00
LinkPreviewController.php feat(bluesky): add link preview cards for posts 2026-07-17 14:32:40 -03:00
NotificationController.php refactor: code review fixes — policies, enums, data_get, tests 2026-03-31 00:40:18 -03:00
OnboardingController.php fix(tracking): fire begin_checkout when onboarding checkout starts 2026-07-02 09:21:31 -03:00
PostAiCreateController.php feat(ai-templates): task 3 - template-driven generator + job 2026-06-17 17:23:33 -03:00
PostAiGenerateController.php refactor(posts): centralize post editing status checks with PostStatusGuard 2026-05-21 19:27:19 -03:00
PostAiRegenerateMediaController.php refactor(posts): replace PostStatusGuard with PostStatusRules for editing and deletion checks 2026-05-21 19:32:42 -03:00
PostAiReviewController.php refactor(posts): centralize post editing status checks with PostStatusGuard 2026-05-21 19:27:19 -03:00
PostCommentController.php feat: @mentions in comments, AI Action layer + MCP tools, settings tabs 2026-05-01 20:59:03 -03:00
PostController.php fix(permissions): address code-review findings 2026-06-22 18:00:36 -03:00
PostTemplateController.php refactor: drop RenderedSlide DTO and content_language null fallbacks 2026-05-08 19:32:51 -03:00
PresenceController.php feat: @mentions in comments, AI Action layer + MCP tools, settings tabs 2026-05-01 20:59:03 -03:00
UnsplashController.php feat: complete AI assistant with custom services and brand config 2026-04-16 09:25:08 -03:00
WorkspaceController.php Fail loud on a missing coupon and block unpaid extra workspaces 2026-07-09 15:37:25 -03:00
WorkspaceInviteController.php fix(members): block self role-change/removal and lock role rules with tests 2026-06-22 14:41:11 -03:00
WorkspaceLabelController.php refactor: code review fixes — policies, enums, data_get, tests 2026-03-31 00:40:18 -03:00
WorkspaceSignatureController.php chore: remove deprecated localization files 2026-05-03 15:23:25 -03:00