Files
MokoSuiteCross/source
Jonathan Miller 9484d6bde9
Generic: Repo Health / Site Health (push) Has been cancelled
Generic: Repo Health / Access control (push) Has been cancelled
Generic: Repo Health / Scripts governance (push) Has been cancelled
Generic: Repo Health / Repository health (push) Has been cancelled
Generic: Repo Health / Report Issues (push) Has been cancelled
security: fix 9 security and critical bugs (#107-#115, #120)
- #107: Fix testConnection() broken event dispatch (Joomla 5+
  ArrayAccess pattern) and add CSRF + ACL checks
- #108: Add CSRF checkToken() to OauthController::authorize()
- #109: Add core.manage ACL check to REST dispatch endpoint
- #110: Fix LinkedIn null-coalesce on organization_id
- #111: Add CURLOPT_PROTOCOLS to webhook, mastodon, ghost, bluesky
  to prevent SSRF via user-controlled URLs
- #112: Encrypt credentials at rest using sodium_crypto_secretbox
  with key derived from Joomla secret; backward-compat with
  existing plaintext JSON credentials
- #113: Fix unclosed <script> tag in dashboard template
- #114: Fix hasPendingWork() to use exponential backoff matching
  processQueue() instead of linear delay
- #115: Fix timestamp lock TOCTOU race with atomic UPDATE + WHERE
- #120: Add CSRF token to dashboard migration link

Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-06-06 09:33:12 -05:00
..