Jeremy Daer 4efa4da809 Fix IDOR in webhook activation endpoint (#2431) ...

The webhook activation controller was using account-scoped lookup
instead of board-scoped lookup, allowing users to reactivate webhooks
on boards they don't have access to.

This was an oversight when board-scoping was added to the main webhooks
controller - the activations controller was missed in that update.

The fix adds the BoardScoped concern to properly restrict webhook
activation to boards the user has explicit access to.

2026-01-24 17:06:12 -08:00

..

account

Add self-service account deletion (#2246)

2026-01-12 14:21:05 +01:00

boards

replace destroy column turbo stream for redirect_back_or_to

2025-12-11 10:42:44 +01:00

cards

Allow boosts on cards (#2411)

2026-01-23 13:25:55 -05:00

columns

Baseline replacing collection with board across code

2025-11-05 13:31:54 +01:00

concerns

Add self-service account deletion (#2246)

2026-01-12 14:21:05 +01:00

events

More robust implementation to prevent method injection attacks

2025-11-21 10:38:16 +01:00

filters

Several fixes for saving filters

2025-09-22 12:55:19 +02:00

my

Add self-service account deletion (#2246)

2026-01-12 14:21:05 +01:00

notifications

Fix deprecation warnings for skip_before_action :verify_authenticity_token

2026-01-12 18:44:35 +02:00

prompts

Use Card number as the model param

2025-11-17 09:12:41 -05:00

public

Add self-service account deletion (#2246)

2026-01-12 14:21:05 +01:00

searches

Remove anemic concern

2025-11-03 15:27:12 +01:00

sessions

Add self-service account deletion (#2246)

2026-01-12 14:21:05 +01:00

signups

Stub welcome letter for newly created accounts

2025-12-19 15:36:52 -06:00

users

Use relative URLs where possible across all the app

2026-01-14 11:01:42 +01:00

webhooks

Fix IDOR in webhook activation endpoint (#2431)

2026-01-24 17:06:12 -08:00

admin_controller.rb

Make mission control only accessible for staff members

2025-11-28 15:53:58 +01:00

application_controller.rb

refactor: use MULTI_TENANT env variable, model concern instead of controller (#accepting_signups?)

2025-12-10 15:14:22 +01:00

boards_controller.rb

Refactor: Replace pluck(:id) with ids method

2026-01-04 10:02:58 -03:00

cards_controller.rb

Use a dedicated resource for showing cards in draft mode

2026-01-08 10:40:21 +01:00

events_controller.rb

Remove unnecessary filtering code

2025-10-03 10:56:34 +02:00

filters_controller.rb

Several fixes for saving filters

2025-09-22 12:55:19 +02:00

join_codes_controller.rb

feat: add rate limit to join codes controller

2025-12-12 17:21:57 +01:00

landings_controller.rb

Ensure the flash notice passes through the redirect

2025-12-20 18:04:56 -06:00

notifications_controller.rb

Lower the number of returned unread notifications

2025-12-10 09:23:52 +01:00

pwa_controller.rb

Fix authentication on "untenanted" controllers

2025-11-17 09:11:47 -05:00

qr_codes_controller.rb

Scope jobs and controllers by account

2025-11-17 09:12:41 -05:00

searches_controller.rb

Inline anemic method

2025-11-18 15:48:40 +01:00

sessions_controller.rb

Replace handle_ naming

2025-12-19 19:21:58 +01:00

signups_controller.rb

Naming

2025-12-11 11:20:43 +00:00

tags_controller.rb

Add pagination to most places and fix cards pagination

2025-12-10 09:23:52 +01:00

users_controller.rb

Redirect back to account settings page when the user role is changed or when the user is removed from an account.

2025-12-22 10:47:23 +02:00

webhooks_controller.rb

Baseline replacing collection with board across code

2025-11-05 13:31:54 +01:00