 robbond
|
63c56da143
|
fix(security): disable legacy XSS browser filter
|
2026-11-09 15:56:30 +00:00 |
|
|
robbond
|
ff84e9ea0f
|
fix(security): use server-configured PET notification recipient
|
2026-11-09 14:04:31 +00:00 |
|
|
robbond
|
f4f8075af3
|
fix(security): harden Contact Us PET notifications
|
2026-11-09 13:41:31 +00:00 |
|
|
robbond
|
3c0a9ef721
|
fix(security): harden Contact Us sender confirmations
|
2026-11-09 13:06:22 +00:00 |
|
|
robbond
|
b821dc2092
|
fix(security): append Contact Us CRM activity reminder
|
2026-11-09 12:07:08 +00:00 |
|
|
robbond
|
b15ac5e664
|
fix(security): harden Contact Us CRM task endpoint
|
2026-11-09 11:17:17 +00:00 |
|
|
robbond
|
fef9591b5d
|
fix(security): protect representation blob deletion against CSRF
|
2026-11-09 09:31:41 +00:00 |
|
|
robbond
|
4eba824ac2
|
fix(security): protect case blob deletion against CSRF
|
2026-11-09 07:56:59 +00:00 |
|
|
robbond
|
12b0e5eff0
|
fix(storage): await recursive blob deletions and propagate failures
|
2026-11-07 11:17:48 +00:00 |
|
|
robbond
|
57e0c62940
|
fix(storage): constrain recursive blob deletion to resource folders
|
2026-11-07 11:12:08 +00:00 |
|
|
robbond
|
bb8c5047c8
|
Merge ITHC recovery into mitigation baseline
|
2026-11-07 07:55:52 +00:00 |
|
|
robbond
|
1377aebc89
|
fix: enforce representation blob ownership and secure SSR access
|
2026-11-06 17:05:40 +00:00 |
|
|
robbond
|
946d361a67
|
test: cover ITHC cross-user blob deletion protection
|
2026-11-06 13:02:49 +00:00 |
|
|
robbond
|
c49b491698
|
refactor: migrate myportal viewall account lookup to server helper
|
2026-11-06 11:58:01 +00:00 |
|
|
robbond
|
bf2e4a3254
|
refactor: migrate myportal index account lookup to server helper
|
2026-11-06 11:33:49 +00:00 |
|
|
robbond
|
4b552e9cdd
|
refactor: extract server-side CRM personal account lookup
|
2026-11-06 11:22:42 +00:00 |
|
|
robbond
|
b9be188d27
|
security: enforce CRM contact ownership and account field allowlist
|
2026-11-06 10:55:47 +00:00 |
|
|
robbond
|
71de8a2d14
|
refactor: extract server-side CRM contact update
|
2026-11-06 09:58:02 +00:00 |
|
|
robbond
|
ddcef8f5ea
|
security: remove obsolete CRM login endpoint
|
2026-11-06 09:22:29 +00:00 |
|
|
robbond
|
f7479b72b9
|
security: remove obsolete CRM password update functionality
|
2026-11-06 09:14:54 +00:00 |
|
|
robbond
|
e1f8fb5c96
|
Revert "security: enforce authenticated CRM contact ownership"
This reverts commit e13700ab65.
|
2026-11-06 06:42:16 +00:00 |
|
|
robbond
|
e13700ab65
|
security: enforce authenticated CRM contact ownership
|
2026-11-06 06:36:53 +00:00 |
|
|
robbond
|
a0a1331a97
|
fix(security): retire obsolete CRM representation deletion endpoint
|
2026-11-05 17:18:30 +00:00 |
|
|
robbond
|
faf3aa3675
|
fix(security): enforce ownership on private draft case creation
|
2026-11-05 16:58:35 +00:00 |
|
|
robbond
|
9b0cb9adc8
|
fix(security): retire legacy direct CRM case creation endpoint
|
2026-11-05 16:37:10 +00:00 |
|
|
robbond
|
93bf7e174f
|
fix(security): enforce ownership on private draft PDF generation
|
2026-11-05 14:11:45 +00:00 |
|
|
robbond
|
8b045ab781
|
fix(security): enforce ownership across appeal completion
|
2026-11-05 13:28:43 +00:00 |
|
|
robbond
|
fc960f907f
|
fix(security): enforce ownership on private draft blob deletion
|
2026-11-05 13:04:09 +00:00 |
|
|
robbond
|
056dace563
|
fix(security): enforce ownership on draft blob listing proxy
|
2026-11-05 12:59:55 +00:00 |
|
|
robbond
|
9d6d3b9f71
|
fix(security): enforce ownership on appeal and representation blob proxies
|
2026-11-05 12:53:24 +00:00 |
|
|
robbond
|
0a115a8808
|
security: preserve representation history in watched-case upsert
|
2026-11-05 12:48:45 +00:00 |
|
|
robbond
|
706083b6f0
|
test: update endpoint contract fixtures and add test filtering
|
2026-11-05 10:25:59 +00:00 |
|
|
robbond
|
431c45ba2b
|
security: enforce CRM watched-case deletion ownership
|
2026-11-05 10:24:52 +00:00 |
|
|
robbond
|
2badf2e272
|
security: enforce authenticated CRM contact ownership
|
2026-11-05 06:49:00 +00:00 |
|
|
robbond
|
601668a675
|
security: enforce CRM watched-case deletion ownership
|
2026-11-04 17:44:05 +00:00 |
|
|
robbond
|
d0ce82c69f
|
security: retire obsolete CRM representation deletion endpoint
|
2026-11-04 17:10:23 +00:00 |
|
|
robbond
|
5729625229
|
fix(security): enforce ownership on private draft case creation
|
2026-11-04 16:07:23 +00:00 |
|
|
robbond
|
b59959fb83
|
fix(security): enforce ownership on private draft PDF generation
|
2026-11-04 15:36:52 +00:00 |
|
|
robbond
|
4829c49c7b
|
fix(security): enforce ownership across appeal completion
|
2026-11-04 14:20:11 +00:00 |
|
|
robbond
|
f8245861b7
|
fix(security): enforce ownership on private draft blob deletion
|
2026-11-04 14:01:50 +00:00 |
|
|
robbond
|
9d8678f52a
|
fix(security): enforce ownership on draft blob listing proxy
|
2026-11-04 13:45:56 +00:00 |
|
|
robbond
|
7649ad3615
|
fix(security): enforce ownership on appeal and representation blob proxies
|
2026-11-04 13:23:51 +00:00 |
|
|
robbond
|
569faa77e5
|
fix(security): isolate NextAuth email provider from Nodemailer
|
2026-11-04 11:26:01 +00:00 |
|
|
robbond
|
d9f0c0797d
|
fix(security): strip video embeds from rich text linkification
|
2026-11-04 10:51:56 +00:00 |
|
|
robbond
|
ebe8cab03f
|
fix(deps): migrate ESLint tooling for Next.js 16
|
2026-11-04 10:01:40 +00:00 |
|
|
robbond
|
3f91a3e095
|
fix(security): replace nookies with patched cookie utility
|
2026-11-04 06:54:36 +00:00 |
|
|
robbond
|
16ca736789
|
chore(deps): update NextAuth v4 compatibility baseline
|
2026-11-03 10:15:53 +00:00 |
|
|
robbond
|
bb50b17277
|
fix(ithc): correct server-side session retrieval for file APIs
|
2026-11-03 09:25:02 +00:00 |
|
|
robbond
|
d417860d1d
|
Merge branch 'SIPS-Development' into feature/ithc-mitigation
|
2026-11-02 16:05:12 +00:00 |
|
 Robert Bond
|
93eabe8e6d
|
Merged PR 2665: 25470 testing authentication handler
Related work items: #25470
|
2026-11-02 12:41:09 +00:00 |
|