Mike Dalessio 4579f7cd61 Avoid string manipulation when autolinking. ...

Instead, let's use a Loofah scrubber which will create DOM nodes
directly. This should be faster and is a tiny bit simpler, as well as
removing a potential HTML injection vector.

Also, add "noreferrer" to all `mailto:` links (already present on URLs).

2025-12-29 12:21:00 -05:00

..

channels/application_cable

+ connection_test.rb

2025-12-03 16:40:44 +03:00

controllers

Merge pull request #2244 from basecamp/expose-card-ids-on-comments

2025-12-24 08:50:47 +01:00

fixtures

Add billing system with Stripe

2025-12-16 16:44:20 +01:00

helpers

Avoid string manipulation when autolinking.

2025-12-29 12:21:00 -05:00

integration

Consider user avatars always public

2025-12-26 19:33:26 +01:00

jobs

Storage: harden reconcile for concurrent writes and fix board transfer (#2096)

2025-12-19 13:07:32 -08:00

lib

Drop the "max previewable file size" limit

2025-11-21 10:55:20 -05:00

mailers

Fix ActiveStorage FileNotFoundError with immediate variant processing (#2022)

2025-12-08 14:44:49 -08:00

middleware

Add tests for tenancy middleware and timezone cookie

2025-12-13 22:10:21 +02:00

models

Fix HTML injection in webhooks through card titles

2025-12-22 12:20:32 +01:00

system

Add test coverage for the image lightbox

2025-12-13 16:00:54 -05:00

test_helpers

Pin sign in attempts to the current session

2025-12-11 19:05:54 +01:00

application_system_test_case.rb

Introduce a few system tests

2025-09-13 13:18:32 -04:00

routes_test.rb

Rename Entropy::Configuration to just Entropy

2025-11-02 13:11:41 +01:00

test_helper.rb

Extract hex_to_base36 and base36_to_hex methods in Uuid type

2025-12-16 14:16:55 -05:00