Mike Dalessio b6ea558de8 Move TrackTrueClientIp middleware into saas engine (#2677) ...

The True-Client-IP header is set by Cloudflare and is only trustworthy
when behind a Cloudflare proxy. In non-Cloudflare deployments, this
header is attacker-controlled and can be used to spoof IP addresses.

Moving the middleware into the saas engine ensures it only loads for our
Cloudflare-fronted production deployment, not for self-hosted OSS
instances.

GHSA-cpch-9qg2-x8fq

2026-03-09 15:14:17 -04:00

..

channels/application_cable

+ connection_test.rb

2025-12-03 16:40:44 +03:00

controllers

Add JSON response format for full SDK/CLI coverage (#2675)

2026-03-09 11:39:49 -07:00

fixtures

Stabilize notifications tray test ordering via fixture updated_at timestamps

2026-02-16 18:33:32 +03:00

helpers

Render inline code in card titles (#2518)

2026-02-12 12:07:40 -05:00

integration

Fix tests for renamed fixtures and new stacked notifications

2026-02-25 19:31:13 +01:00

jobs

Rename jobs

2026-02-02 18:22:07 +01:00

lib

Move TrackTrueClientIp middleware into saas engine (#2677)

2026-03-09 15:14:17 -04:00

mailers

Fix crash when a notification is deleted while a bundle is being sent

2026-02-13 09:22:51 +01:00

middleware

Remove zero-padding from account slug

2026-01-28 11:59:42 +00:00

models

Touch board when publication is created or destroyed (#2674)

2026-03-09 13:59:57 -04:00

system

Stack notifications everywhere

2026-02-12 10:29:50 +01:00

test_helpers

prefactor: update search to use published cards

2026-01-23 11:07:43 -05:00

application_system_test_case.rb

Introduce a few system tests

2025-09-13 13:18:32 -04:00

routes_test.rb

Rename Entropy::Configuration to just Entropy

2025-11-02 13:11:41 +01:00

test_helper.rb

Add integration test for notification delivery and simplify test helpers

2026-02-25 19:31:13 +01:00

webmock_ipaddr_extension.rb

Correctly initialise WebPush connection (#2417)

2026-01-22 12:03:02 -08:00