Jeremy Daer 9f6a4f1cc6 Fix unauthorized column reordering ...

Users could reorder columns they didn't have access to. Fixed by
limiting ColumnScoped to User::Accessor#accessible_columns.

References https://hackerone.com/reports/3449905

2025-12-03 13:00:49 -08:00

..

authentication.rb

Add some protections around sharing the magic link in development

2025-12-02 10:51:14 +01:00

authorization.rb

Only staff can access beta/staging

2025-11-28 15:53:58 +01:00

block_search_engine_indexing.rb

Robots, begone (#1812)

2025-12-02 13:35:58 -08:00

board_scoped.rb

Ensure only admins/creators can publish boards

2025-11-12 11:48:35 +01:00

card_scoped.rb

Use Card number as the model param

2025-11-17 09:12:41 -05:00

column_scoped.rb

Fix unauthorized column reordering

2025-12-03 13:00:49 -08:00

current_request.rb

Aesthetics

2025-10-29 13:37:14 +01:00

current_timezone.rb

Mark for upstreaming

2025-10-29 13:41:11 +01:00

day_timelines_scoped.rb

Support filter by collection in different screens

2025-08-21 14:19:13 +02:00

filter_scoped.rb

Remove unnecessary filtering code

2025-10-03 10:56:34 +02:00

request_forgery_protection.rb

Switch from report-only to actually using Sec-Fetch-Site for CSRF protection

2025-11-28 16:26:03 +01:00

routing_headers.rb

Add routing header to see who served request

2025-11-17 09:12:41 -05:00

set_platform.rb

Detect platform and label the correct hotkey shortcut

2025-05-27 12:14:24 -05:00

turbo_flash.rb

Prefer templates for turbo streams in all but the very simplest cases

2025-11-02 20:20:01 +01:00

view_transitions.rb

We need to upstream this fix to turbo-rails

2025-10-29 13:47:51 +01:00