Mike Dalessio b6ea558de8 Move TrackTrueClientIp middleware into saas engine (#2677) ...

The True-Client-IP header is set by Cloudflare and is only trustworthy
when behind a Cloudflare proxy. In non-Cloudflare deployments, this
header is attacker-controlled and can be used to spoof IP addresses.

Moving the middleware into the saas engine ensures it only loads for our
Cloudflare-fronted production deployment, not for self-hosted OSS
instances.

GHSA-cpch-9qg2-x8fq

2026-03-09 15:14:17 -04:00

..

tenanting

Remove zero-padding from account slug

2026-01-28 11:59:42 +00:00

action_text.rb

Implement authorization for Active Storage endpoints

2025-12-25 21:22:36 +01:00

active_job.rb

Make sure jobs are enqueued only after all transactions are committed

2025-11-20 18:47:42 -05:00

active_storage_no_reuse.rb

Allow ActionText embed reuse and safe purge (#2346)

2026-01-12 10:30:18 -08:00

active_storage_purge_on_last_attachment.rb

Fix orphaned attachments when deleting the whole account

2026-02-02 14:35:01 +01:00

active_storage.rb

Use relative URLs for avatars and rich text attachments

2026-01-14 11:01:42 +01:00

assets.rb

New Rails app

2024-06-21 13:19:56 +01:00

autotuner.rb

Autotuner: use structured logging instead of Sentry (#2011)

2025-12-08 10:01:28 -08:00

content_security_policy.rb

CSP: full config with env vars per source (#2069)

2025-12-10 17:21:09 -08:00

database_role_logging.rb

Disable multi-db for SQLite

2025-11-21 09:15:19 +00:00

error_context.rb

Add lazy error context for Rails error reporter (#2014)

2025-12-08 11:00:40 -08:00

extensions.rb

Support search on markdown fields

2024-11-29 14:28:37 -06:00

filter_parameter_logging.rb

Set up Rubocop

2024-06-21 16:42:48 +01:00

inflections.rb

Fix load error

2026-02-02 12:49:39 +01:00

mission_control.rb

Turn off the help notice

2025-12-01 16:25:23 +01:00

multi_db.rb

Fix indentation in multi_db.rb initializer (#2082)

2025-12-11 20:37:28 -08:00

multi_tenant.rb

Scope the config option

2025-12-11 11:28:32 +00:00

permissions_policy.rb

New Rails app

2024-06-21 13:19:56 +01:00

push_notifications.rb

Refactor notification push system with registry pattern

2026-02-25 19:31:13 +01:00

rack_mini_profiler.rb

Make sure rack-mini-profiler doesn't load in test

2025-11-17 15:03:26 -05:00

sanitization.rb

Lightbox uses Stimulus target callbacks instead of data-action

2025-12-13 17:06:03 -05:00

sqlite_schema_dumper.rb

Tidy up modules and on_load points

2025-11-26 10:02:32 +00:00

table_definition_column_limits.rb

Handle size in binary columns

2025-12-01 13:32:54 +01:00

uuid_framework_models.rb

Auto default for UUID primary keys

2025-12-03 14:27:52 +00:00

uuid_primary_keys.rb

Auto default for UUID primary keys

2025-12-03 14:27:52 +00:00

vapid.rb

Remove vapid keys in development

2025-11-28 15:53:58 +01:00

vips.rb

Raise a clear exception if libvips is not installed

2025-12-19 09:22:55 -05:00

web_push.rb

Correctly initialise WebPush connection (#2417)

2026-01-22 12:03:02 -08:00