Jan Sandbrink 5689a105a0 Work around SSRF issue ...

Ingredients needed for the issue to occur are:

* an allowed IPv4 range
* a checked IPv6 address
* the checked address must be wrapped in HTTPX::Resolver::Entry

This leads to a failure in checking address inclusion by IPAddr.

2026-06-08 08:15:38 +02:00

..

access_control

…

acts_as_url/adapter

implement skip_if logic for OpActiveRecord

2026-03-24 12:48:23 +01:00

cache

…

custom_styles

…

health_checks

…

hooks

Also render announcement component on login

2025-10-28 09:17:33 +01:00

inplace_edit

Get inplaceEditField for customField dynamically by the format instead of registring them all directly

2026-03-20 08:40:33 +01:00

internationalization

Add monthly scheduling options

2026-05-20 15:20:16 +02:00

journal

…

journal_formatter

Use formatted_id in journal cause formatter and link_to_work_package

2026-05-13 17:41:48 +03:00

logging

Fix error when users table does not exist (#21482)

2025-12-18 15:12:26 +01:00

metrics

expose reduced set of metrics used for auto scaling

2025-09-25 11:29:34 +02:00

nested_set

Consistently use OpenProject::SqlSanitization instead of forwarding to sanitize_sql_array

2026-05-27 10:08:16 +02:00

omni_auth

…

patches

Merge branch 'release/17.4' into release/17.5

2026-05-22 08:36:48 +00:00

plugins

Improve readability of patch_with_namespace

2026-05-05 08:35:45 +02:00

rate_limiting

Add rack-attack throttler for all logins

2026-05-29 12:33:28 +02:00

scm

Merge branch 'release/17.3' into dev

2026-04-23 04:33:10 +00:00

static

Remove special from semver

2025-11-10 20:45:13 +01:00

text_formatting

Merge remote-tracking branch 'origin/release/17.4' into release/17.5

2026-06-01 13:57:42 +02:00

translations

…

ui

Use reminders form component for the admin view as well and remove now outdated angular components

2026-03-26 15:15:29 +01:00

access_control.rb

Do not show Resource Management permissions in Role Editor

2026-05-05 15:30:51 +02:00

access_keys.rb

…

assets.rb

…

cache.rb

Fix merge of release/17.3 into 17.4

2026-05-19 19:55:48 +02:00

changed_by_system.rb

…

confidential_cache.rb

Introduce and use ConfidentialCache

2026-05-19 15:56:53 +02:00

content_type_detector.rb

Extract and use charset to properly encode attachments

2026-05-29 10:26:43 +02:00

custom_field_format_dependent.rb

allow comments for all field formats

2026-02-25 16:00:16 +01:00

custom_field_format.rb

group and cleanup helper custom field class methods

2026-05-19 17:42:45 +02:00

deprecation.rb

…

enterprise.rb

…

events.rb

[#71305] Introduce MODULE_ENABLED event and use it for backlogs

2026-05-19 14:21:54 +02:00

file_command_content_type_detector.rb

Be more cautious when parsing charset from file

2026-05-29 10:30:07 +02:00

files.rb

Properly build uploaded tempfile with basename

2026-02-18 09:58:04 +01:00

footer.rb

…

form_tag_helper.rb

Fix id parsing for wiki toolbar now that we use actual html

2026-03-20 09:49:11 +01:00

full_text_search.rb

Consistently use OpenProject::SqlSanitization instead of forwarding to sanitize_sql_array

2026-05-27 10:08:16 +02:00

global_search.rb

…

hook.rb

…

hooks.rb

Also render announcement component on login

2025-10-28 09:17:33 +01:00

html_diff.rb

…

httpx_appsignal.rb

…

httpx_ssrf_filter.rb

Work around SSRF issue

2026-06-08 08:15:38 +02:00

info.rb

…

locale_helper.rb

…

logging.rb

…

menu.rb

Fix wording: Change "Favored" to "Favorited"

2025-09-10 19:08:15 +01:00

mime_type.rb

Remove narrow mime type

2026-01-09 08:16:04 +01:00

multi_key_hash.rb

…

mutex.rb

fix log message when fetching advisory lock

2026-01-08 17:27:34 +01:00

object_linking.rb

Pass class option to non-linkable instances as well

2026-05-28 13:02:42 +02:00

page_hierarchy_helper.rb

Replace raw and explicit html_safe calls

2026-03-20 09:49:10 +01:00

passwords.rb

Remove password min-rules in favor of clearly listed/checked password rules

2026-04-22 13:43:42 +02:00

patches.rb

…

plugins.rb

…

postgres_environment.rb

…

rate_limiting.rb

Add rack-attack throttler for all logins

2026-05-29 12:33:28 +02:00

remove_invisible_characters.rb

fix(documents): strip invisible characters from document titles

2026-03-31 18:18:41 +03:00

repository_authentication.rb

…

safe_params.rb

…

sql_sanitization.rb

…

ssrf_protection.rb

Use ssrf filtering in Jira Import.

2026-04-21 10:29:45 +02:00

storage.rb

…

syntax_highlighting.rb

…

text_formatting.rb

Add render_mode flag and MailFormattingHelper

2026-05-27 13:04:26 +03:00

version.rb

Bumped version to 17.6.0

2026-05-21 06:55:20 +02:00