Mike Dalessio 8fb57ace01 Validate polymorphic types against importable models allowlist ...

Add IMPORTABLE_MODEL_NAMES to RecordSet and verify polymorphic type
columns during import check against this allowlist before calling
constantize. This prevents arbitrary class instantiation from
untrusted import ZIP data.

2026-03-10 15:33:24 -04:00

..

account

Validate polymorphic types against importable models allowlist

2026-03-10 15:33:24 -04:00

board

Touch board when publication is created or destroyed (#2674)

2026-03-09 13:59:57 -04:00

card

Validate and normalize auto-postpone period to days (#2672)

2026-03-09 17:37:56 -04:00

column

Keep current logical names for colors

2025-11-14 11:44:04 +01:00

comment

Guard search indexing with searchable? check

2026-01-23 12:13:08 -05:00

concerns

Fix tests for renamed fixtures and new stacked notifications

2026-02-25 19:31:13 +01:00

event

Fix double-escaped HTML entities in webhook payloads

2026-02-13 03:25:59 -05:00

filter

prefactor: update search to use published cards

2026-01-23 11:07:43 -05:00

identity

Drop the need for access tokens to have a session

2025-12-10 09:23:52 +01:00

magic_link

Replace custom code generator with Base32

2025-12-12 07:45:23 +01:00

notification

Reapply "Push event payload body updates"

2026-03-02 16:15:28 +01:00

notifier

Fix duplicate push notification for mention and comment event

2026-02-24 15:56:27 +01:00

push

Allow chromium unstable endpoint

2025-12-09 20:24:09 -05:00

search

Add repeated punctuation search stemmer test

2026-02-19 16:23:26 -06:00

signup

Bring simple signup flow from the fizzy-saas gem

2025-11-28 15:53:58 +01:00

storage

Allow ActionText embed reuse and safe purge (#2346)

2026-01-12 10:30:18 -08:00

user

Stack notifications everywhere

2026-02-12 10:29:50 +01:00

webhook

Fix double-escaped HTML entities in webhook payloads

2026-02-13 03:25:59 -05:00

access_test.rb

Delete pins belonging to cards in a board with revoked access

2026-01-13 16:25:59 +01:00

account_test.rb

Add verified_at timestamp to use for spam prevention

2025-12-05 21:51:44 -05:00

assignment_test.rb

Limit asignees to 10 per card

2025-12-15 16:40:52 +01:00

card_test.rb

Move comment events when card moves to a new board (#2486)

2026-02-04 15:04:28 -05:00

column_limits_test.rb

Enforce SQLite column limits via CHECK constraints

2025-11-26 09:50:29 +00:00

column_test.rb

Revert "Revert "Color a11y""

2025-11-14 11:24:55 +01:00

comment_test.rb

Forbid comments on draft cards

2026-01-23 11:28:26 -05:00

entropy_test.rb

Validate and normalize auto-postpone period to days (#2672)

2026-03-09 17:37:56 -04:00

filter_test.rb

Scope the single-board case to just the creator's boards (#1880)

2025-12-03 15:47:04 -08:00

identity_test.rb

Fix Identity destruction callback ordering

2025-12-08 15:12:38 -05:00

magic_link_test.rb

Make sign up Magic Links work across devices

2025-11-29 12:36:00 +01:00

notification_test.rb

Stack notifications everywhere

2026-02-12 10:29:50 +01:00

qr_code_link_test.rb

Add session transfer feature

2024-12-18 12:38:53 -06:00

reaction_test.rb

Allow boosts on cards (#2411)

2026-01-23 13:25:55 -05:00

search_test.rb

Add tests for hyphenated string search

2026-02-19 16:16:44 -06:00

signup_test.rb

Limit length of full name during signup

2025-12-15 09:56:35 +00:00

ssrf_protection_test.rb

Block IPv4-compatible IPv6 addresses in SSRF protection (#2273)

2025-12-29 21:45:06 -08:00

tag_test.rb

Introduce a recurring job to delete unused tags

2025-05-14 12:35:52 -04:00

time_window_parser_test.rb

Add support for filtering by creation or completion windows of times

2025-06-27 13:38:22 +02:00

user_test.rb

Validate User name presence and handle blank names gracefully

2025-12-16 10:44:10 -05:00

webhook_test.rb

Add test for webhook URL with trailing whitespace

2026-01-15 22:13:41 -05:00

zip_file_test.rb

Handle MissingEOCD as invalid zip file, not job failure (#2572)

2026-02-18 15:18:56 -08:00