Jeremy Daer 9f6a4f1cc6 Fix unauthorized column reordering ...

Users could reorder columns they didn't have access to. Fixed by
limiting ColumnScoped to User::Accessor#accessible_columns.

References https://hackerone.com/reports/3449905

2025-12-03 13:00:49 -08:00

..

accounts

Add "data export" feature

2025-12-01 15:23:26 +00:00

admin

Make mission control only accessible for staff members

2025-11-28 15:53:58 +01:00

boards

Fix test from 0d55c966 to use Current.account

2025-11-17 09:14:23 -05:00

cards

Allow only the owner of a reaction to delete it

2025-12-03 11:10:44 +01:00

columns

Fix unauthorized column reordering

2025-12-03 13:00:49 -08:00

concerns

Robots, begone (#1812)

2025-12-02 13:35:58 -08:00

events/day_timeline

Update test

2025-11-24 12:04:33 +01:00

my

Persist timezones in the server

2025-09-05 12:11:57 +02:00

notifications

Fix: mark all as read wasn't refreshing in the notifications screen

2025-11-04 06:12:30 +01:00

prompts

Constrain user queries to the current or relevant account

2025-11-17 09:11:57 -05:00

public

Replace collection with board in the code, tests green

2025-11-05 13:41:12 +01:00

searches

Format

2025-06-24 13:26:37 +02:00

sessions

Make sign up Magic Links work across devices

2025-11-29 12:36:00 +01:00

signup

Bring simple signup flow from the fizzy-saas gem

2025-11-28 15:53:58 +01:00

users

Introduce an "owner" role, and prevent it from being administered

2025-11-29 14:13:29 -05:00

webhooks

Baseline replacing collection with board across code

2025-11-05 13:31:54 +01:00

allow_browser_test.rb

Update useragent to recognize twitterbot/facebot

2025-11-25 18:05:21 -05:00

boards_controller_test.rb

Allow only people who can administer a board to delete it

2025-12-03 10:56:05 +01:00

cards_controller_test.rb

Update card buttons dynamically

2025-11-22 12:14:39 -05:00

controller_authentication_test.rb

Remove the internal API

2025-10-31 16:26:08 +01:00

events_controller_test.rb

Baseline replacing collection with board across code

2025-11-05 13:31:54 +01:00

filters_controller_test.rb

Make IDs more time-sortable in tests

2025-11-17 09:12:40 -05:00

join_codes_controller_test.rb

Fix crash in join code redemption race condition

2025-12-03 13:29:20 +01:00

landings_controller_test.rb

Redirect to root to avoid changing the path by default

2025-11-05 19:00:50 +01:00

non_production_remote_access_test.rb

Only staff can access beta/staging

2025-11-28 15:53:58 +01:00

notifications_controller_test.rb

Add an index view for all notifications

2025-01-16 17:48:38 +00:00

searches_controller_test.rb

Fix rubocop

2025-11-21 15:30:14 +00:00

sessions_controller_test.rb

Add some protections around sharing the magic link in development

2025-12-02 10:51:14 +01:00

signups_controller_test.rb

Organize everything under Signups

2025-11-29 11:46:09 +01:00

users_controller_test.rb

Introduce an "owner" role, and prevent it from being administered

2025-11-29 14:13:29 -05:00

webhooks_controller_test.rb

Make IDs more time-sortable in tests

2025-11-17 09:12:40 -05:00