Paulo Castellano 4a08913d70 fix(security): make SSRF private-network block configurable and guard the last user-URL fetches ... Add config('trypost.security.allow_private_network') (env TRYPOST_ALLOW_PRIVATE_NETWORK, default off) so self-hosted operators can reach their own internal network; only the private-IP rejection is bypassed, scheme/host checks always apply. Add SafeHttpFetcher::guardedRequest() and route the last unguarded user-supplied-URL fetches through it: the Unsplash/Giphy asset import, the API/MCP attach-media-from-URL download, and the OAuth avatar download. Our-own-storage reads (media crop, Bluesky media) are intentionally left unguarded so internal storage keeps working when self-hosted.		2026-07-17 15:40:15 -03:00
..
Ai	Centralize supported content languages in a ContentLanguage enum	2026-07-03 14:12:25 -03:00
Brand	fix(security): make SSRF private-network block configurable and guard the last user-URL fetches	2026-07-17 15:40:15 -03:00
Image	Structure brand voice and make generated copy platform-aware	2026-06-12 17:09:39 -03:00
Media	Render the story background as a soft, lightened blur	2026-07-17 10:31:35 -03:00
Post	fix(security): make SSRF private-network block configurable and guard the last user-URL fetches	2026-07-17 15:40:15 -03:00
Social	feat(bluesky): add link preview cards for posts	2026-07-17 14:32:40 -03:00
MediaSearchKeyFallbackTest.php	fix(media): don't 500 when the Unsplash/Giphy key is set to null	2026-07-01 12:16:15 -03:00