🚨 Severity: HIGH
💡 Vulnerability: User-provided IMAP `host` in `_test_imap_connection` and `pull_inbox` was not validated against private IPs, creating an SSRF risk.
🎯 Impact: Attackers could abuse the endpoints to port-scan or interact with internal/private network services.
🔧 Fix: Integrated `is_private_ip` from `app.utils.network` to block connections resolving to private, loopback, link-local, or reserved IPs.
✅ Verification: Ran `test_imap_tasks.py` and `test_api_imap_accounts.py` successfully. Checked `ruff` output and diffs. Removed all scratch files from the commit.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Added tests for POST /api/dropbox/list-folders (7 tests) and
POST /api/onedrive/list-folders (7 tests) covering success, subfolder
navigation, empty directories, auth errors, API errors, path
normalization, and alphabetical sorting.
Added view tests for system credentials toggle visibility in Dropbox
setup wizard.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Add PUBLIC_BASE_URL optional config to override auto-detected OAuth redirect URIs
when behind a reverse proxy that doesn't forward X-Forwarded-Proto headers
- Add _build_dropbox_redirect_uri() helper in app/api/dropbox.py
- URL-encode redirect_uri in server-side Dropbox authorization URL
- Add _get_dropbox_callback_url() helper in app/views/dropbox.py
- Pass callback_url to both setup and callback templates
- Update templates to use server-provided callback_url instead of window.location.origin
- Update settings_service.py to register new setting
- Update .env.demo, ConfigurationGuide.md, and DropboxSetup.md documentation
- Add tests for new helper functions and global-authorize-url endpoint
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Replaced the synchronous `requests.post` calls in `app/api/dropbox.py` with asynchronous `httpx.AsyncClient().post` calls. This ensures that the FastAPI event loop is not blocked during network I/O, allowing better concurrent performance.
Also updated the `test_api_dropbox.py` tests to use `httpx.AsyncClient.post` in mocks and properly construct `httpx.RequestError` in exception handling tests.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
E) Wizard DB persistence + worker sync
- app/api/dropbox.py: save-settings persists to DB (primary); .env write
is now best-effort (no 500 on missing file); notify_settings_updated()
called; update-settings already done in previous commit
- app/api/google_drive.py: update-settings + save-settings both persist
to DB and call notify_settings_updated(); .env write remains best-effort
- app/api/onedrive.py: save-settings + update-settings persist to DB +
notify; test-token auto-refresh path persists rotated token via
SessionLocal + notifies; .env write is best-effort throughout
- app/views/wizard.py: setup-wizard POST calls notify_settings_updated()
when settings are saved; GET pre-fills fields from DB > ENV > default
with a source badge; new GET /setup/undo-skip route removes skip marker
F) ENV Exporter
- app/utils/settings_service.py: get_settings_for_export(db, source)
supports source=db (DB-only) and source=effective (full runtime config)
- app/api/settings.py: GET /api/settings/export-env admin-only endpoint
returns downloadable .env file; source= query param selects scope
- frontend/templates/settings.html: Export .env dropdown (DB / effective)
+ Setup Wizard button added alongside existing Audit Log button
G) Setup Wizard improvements
- frontend/templates/setup_wizard.html: inputs pre-filled with
current_value; DB/ENV/DEFAULT source badges; undo-skip messaging
- app/views/wizard.py: passes setup_skipped flag to template
Tests
- tests/test_wizard_db_persist.py: 28 tests across 7 classes covering
wizard DB persistence, undo-skip, ENV exporter service + endpoint
- tests/test_api_dropbox.py: updated two tests to match new best-effort
.env behavior (was: assert 500; now: assert 200)
- tests/test_api_onedrive_comprehensive.py: same for two OneDrive tests;
fixed settings singleton pollution by adding @patch("app.api.*.settings")
to all new wizard tests that call save/update endpoints
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
copilot-swe-agent[bot]