73c2b00211
Rever to using Ssrf instead of SSRF
...
Ref: https://github.com/basecamp/fizzy/pull/1967#discussion_r2593750027
2025-12-06 11:04:55 +01:00
1b3d7d4276
Fix ipaddr setter
2025-12-05 20:43:56 +01:00
cd3751f4c1
Fix Resolv::DNS always returning no results
2025-12-05 20:09:39 +01:00
7af93765a8
Security: close narrow window of exposure to DNS rebinding ( #1903 )
2025-12-03 23:12:17 -08:00
78c6751fa0
Prohibit link local addresses
2025-12-02 09:32:15 +01:00
fe6df7085f
Finish the rollout of account_id to all core data models
...
Schema:
- add account_id to tables it was missing from
- make account_id a required column everywhere
- add [account_id] indexes, or add `account_id` to existing indices
Models:
- add `belongs_to :account` to all models (default to using a domain
model's account whenever possible)
- add account_id in all the necessary fixtures
- add account_id to insert_all hashes
- pass account_id to a few initialize calls
Miscellaneous:
- update the import script to set account_id
Note that I'm not adding account_id to the join tables primarily
because I couldn't think of an easy way to populate it without making
it a full Join model, and that was more work than I have time to take
on right now.
2025-11-17 09:12:40 -05:00
fc56ad9d7c
Combine uuid-old and uuid branch changes
...
- Switch to binary 16 for UUID keys
- Remove AccountScopedRecord base class, all model use binary uuids now
- Fix the search sql to serialize uuids properly
- Patch the MySQL schema dumper to output binary lengths
2025-11-17 09:12:34 -05:00
e4011ef211
Update primary keys on customer data to UUIDs
...
- schema changes to primary and foreign keys
- fixture changes
- customer data models subclass AccountScopedRecord
- import script updated
2025-11-17 09:12:30 -05:00
03a345609e
Baseline replacing collection with board across code
2025-11-05 13:31:54 +01:00
9ddfe4d803
Fix production Basecamp webhook format
2025-10-01 14:44:36 +02:00
5710aa724f
Send HTML to campfire instead of JSON
2025-09-17 13:16:00 +02:00
661471e9e8
Fix crash due to missing default value
2025-09-17 11:47:46 +02:00
ce1d6469e7
Rename methods for clarity
2025-09-16 20:08:06 +02:00
dd3063b01d
Simplify delinquency tracking
2025-09-16 20:08:03 +02:00
02a421675f
Scope Webhooks to Collections
2025-09-16 20:07:25 +02:00
1d192c9d42
Ignore low-volume webhooks for delinquency checks
2025-09-16 20:04:20 +02:00
fee25a49ea
Periodically cleanup deliveries
2025-09-16 20:04:20 +02:00
9d77b17b8c
Remove encryption
2025-09-16 20:04:20 +02:00
d7db973397
Use the same timestamp from the body in the header
...
Else replay attack prevention doesn't work
2025-09-16 20:04:20 +02:00
df87ee8b35
Rename private IP ranges to disallowed IP ranges
2025-09-16 20:04:20 +02:00
b8317ce88d
Fix indentation
2025-09-16 20:04:20 +02:00
2fc9215b1d
Add support for Basecamp, Campfire & Slack webhooks
2025-09-16 20:04:20 +02:00
4879995013
Serialize events
2025-09-16 20:04:20 +02:00
0bdbc5f5e8
Add abuse prevention
2025-09-16 20:04:18 +02:00
4da69fb69f
Move reactivation out of edit
2025-09-16 20:03:57 +02:00
5c6cad057f
Extract triggering logic into a concern
2025-09-16 20:03:57 +02:00
9d717239e7
Dispatch Webhooks on event creation
2025-09-16 20:03:57 +02:00
9cfd1e43af
Enable subscribing to specific actions
2025-09-16 20:03:57 +02:00
a515ea3b1f
Create webhooks
2025-09-16 20:03:55 +02:00
Stanko K.R.