Rosa Gutierrez 7f5fa6d715 Use Sec-Fetch-Site exclusively for CSRF protection ...

And close the gap with JSON requests, which shouldn't be allowed if
Sec-Fetch-Site is 'cross-site' or 'none', only if it's empty as this
wouldn't be coming from a browser.

2025-12-12 18:37:32 +01:00

..

account

Add validation for the join code usage limit

2025-12-10 10:10:08 -05:00

admin

Add recent signups to the dashboard

2025-12-02 11:18:46 -05:00

boards

Remove redundant respond_to

2025-12-10 15:05:13 +01:00

cards

API: Support created_at for API card and comment creation (#2056)

2025-12-10 19:57:38 -08:00

columns

Baseline replacing collection with board across code

2025-11-05 13:31:54 +01:00

concerns

Use Sec-Fetch-Site exclusively for CSRF protection

2025-12-12 18:37:32 +01:00

events

More robust implementation to prevent method injection attacks

2025-11-21 10:38:16 +01:00

filters

Several fixes for saving filters

2025-09-22 12:55:19 +02:00

my

Move Identities to My::Identities

2025-12-10 15:13:35 +01:00

notifications

Add API for reading notifications

2025-12-10 09:23:52 +01:00

prompts

Use Card number as the model param

2025-11-17 09:12:41 -05:00

public

Append dropped cards instead of relying on server-side rendering to refresh the columns

2025-12-04 18:31:23 +01:00

searches

Remove anemic concern

2025-11-03 15:27:12 +01:00

sessions

Prohibit access to magic links unless an email address

2025-12-11 19:17:39 +01:00

signups

Organize everything under Signups

2025-11-29 11:46:09 +01:00

users

Remove redundant include

2025-12-12 08:58:52 +00:00

webhooks

Scope jobs and controllers by account

2025-11-17 09:12:41 -05:00

admin_controller.rb

Make mission control only accessible for staff members

2025-11-28 15:53:58 +01:00

application_controller.rb

refactor: use MULTI_TENANT env variable, model concern instead of controller (#accepting_signups?)

2025-12-10 15:14:22 +01:00

boards_controller.rb

Add API for creating and updating boards

2025-12-10 09:23:52 +01:00

cards_controller.rb

API: Allow updates to last_active_at (#2076)

2025-12-11 19:06:03 -08:00

events_controller.rb

Remove unnecessary filtering code

2025-10-03 10:56:34 +02:00

filters_controller.rb

Several fixes for saving filters

2025-09-22 12:55:19 +02:00

join_codes_controller.rb

Validate email before creating identity during join code redemption

2025-12-07 13:26:34 -05:00

landings_controller.rb

Redirect to root to avoid changing the path by default

2025-11-05 19:00:50 +01:00

notifications_controller.rb

Lower the number of returned unread notifications

2025-12-10 09:23:52 +01:00

pwa_controller.rb

Fix authentication on "untenanted" controllers

2025-11-17 09:11:47 -05:00

qr_codes_controller.rb

Scope jobs and controllers by account

2025-11-17 09:12:41 -05:00

searches_controller.rb

Inline anemic method

2025-11-18 15:48:40 +01:00

sessions_controller.rb

Pin sign in attempts to the current session

2025-12-11 19:05:54 +01:00

signups_controller.rb

Naming

2025-12-11 11:20:43 +00:00

tags_controller.rb

Add pagination to most places and fix cards pagination

2025-12-10 09:23:52 +01:00

users_controller.rb

Handle user update failures

2025-12-10 09:23:53 +01:00

webhooks_controller.rb

Baseline replacing collection with board across code

2025-11-05 13:31:54 +01:00