This repository has been archived on 2024-08-19. You can view files and clone it, but cannot push or open issues or pull requests.

zotlabs 58aa0f3e1a code_allowed is a real mess. Start the cleanup by remving the account level code allow and limiting to specific channels only. This reduces the possibility of cross channel security issues coming into play. Then provide a single function for checking the code permission. This is only partially done as we often need to check against the observer or logged in channel as well as the resource owner to ensure that this only returns true for local channels which also own the requested resource.

2017-03-13 16:19:47 -07:00

..

Access

more permissions optimisations

2017-02-09 19:52:13 -08:00

Daemon

expire unread system notifications after a year. It would provide a better experience for infrequent visitors if we didn't expire them at all, but at some point we need to draw a line so as not to degrade system performance searching through old notifications that it's highly unlikely will ever be viewed again.

2017-02-28 14:56:26 -08:00

Extend

start removing db backticks

2016-10-03 19:47:36 -07:00

Identity

start of v4

2015-12-06 19:16:38 -08:00

Lib

better handling of mimetype security

2017-03-12 21:55:24 -07:00

Module

code_allowed is a real mess. Start the cleanup by remving the account level code allow and limiting to specific channels only. This reduces the possibility of cross channel security issues coming into play. Then provide a single function for checking the code permission. This is only partially done as we often need to check against the observer or logged in channel as well as the resource owner to ensure that this only returns true for local channels which also own the requested resource.

2017-03-13 16:19:47 -07:00

Render

whitespace

2017-02-27 11:11:53 +01:00

Storage

add file size notes to /cloud actions panel

2017-02-27 15:13:49 -08:00

Text

isolate all the tagadelic core code into a class and reuse it

2016-05-04 19:39:39 -07:00

Web

move admin permission decision out of the router - it is already provided in the module and the higher level check is causing some oembed redirect issues.

2017-02-25 16:22:09 -08:00

Zot

We've passed the deadline for allowing unsigned zot finger tokens. It is now a protocol requirement.

2017-02-24 13:53:49 -08:00