Mike Dalessio b6ea558de8 Move TrackTrueClientIp middleware into saas engine (#2677) ...

The True-Client-IP header is set by Cloudflare and is only trustworthy
when behind a Cloudflare proxy. In non-Cloudflare deployments, this
header is attacker-controlled and can be used to spoof IP addresses.

Moving the middleware into the saas engine ensures it only loads for our
Cloudflare-fronted production deployment, not for self-hosted OSS
instances.

GHSA-cpch-9qg2-x8fq

2026-03-09 15:14:17 -04:00

..

rails_ext

Extract detached-blob guard into its own file

2026-03-02 14:38:19 -07:00

web_push

Fix notification click URL by using correct data property

2026-02-25 19:31:13 +01:00