Christian Krakau-Louis 2192783737 Merge pull request #758 from christianlouis/fix-idor-vuln-8344028020677453820 ...

🛡️ Sentinel: [CRITICAL] Fix authorization bypass in API (IDOR)

2026-03-18 23:17:58 +01:00

..

__init__.py

Merge branch 'main' into copilot/implement-log-off-everywhere-functionality

2026-03-17 12:12:50 +01:00

admin_users.py

fix(auth): activate account on password reset and fix is_active check order

2026-03-08 12:07:25 +00:00

api_tokens.py

feat(ui): add dedicated Devices page for mobile tokens and registered devices

2026-03-17 11:00:36 +00:00

audit_logs.py

fix(security): remove clear-text logging of sensitive data and fix Annotated+Depends pattern

2026-03-16 12:07:04 +00:00

azure.py

style: fix all flake8 linter errors across app/ directory

2026-02-08 17:42:33 +00:00

backup.py

feat(backup): extend backup and restore to PostgreSQL and MySQL/MariaDB

2026-03-08 09:56:58 +00:00

billing.py

fix(security): clarify billing log message wording

2026-03-16 12:23:07 +00:00

common.py

refactor: consolidate get_db into single module

2026-02-09 15:37:23 +00:00

compliance.py

fix(compliance): address code review feedback - add aria-busy, input validation, use IntegrityError

2026-03-10 00:09:08 +00:00

database.py

fix: address code review feedback

2026-03-05 22:22:49 +00:00

diagnostic.py

feat(api): add GET /api/diagnostic/health endpoint for monitoring

2026-03-01 18:36:38 +00:00

dropbox.py

perf: optimize dropbox token refresh by replacing blocking requests with httpx

2026-03-16 09:19:55 +00:00

duplicates.py

perf(duplicates): fix N+1 query in group listing

2026-03-16 09:16:31 +00:00

files.py

Fix authorization bypass in API (IDOR) by applying owner filter

2026-03-18 03:44:12 +00:00

google_drive.py

Fix naming inconsistency in Google Drive API

2026-03-16 08:59:13 +00:00

graphql_api.py

feat(api): add GraphQL endpoint at /graphql with Strawberry

2026-03-11 22:17:25 +00:00

i18n.py

fix(migrations): re-chain mobile devices migration against main and restore merge conflicts

2026-03-11 20:43:29 +00:00

imap_accounts.py

feat(imap): add ImapIngestionProfile model, API, migration and UI

2026-03-12 01:14:19 +00:00

imap_profiles.py

fix(imap): address code review feedback on ingestion profiles

2026-03-12 01:19:32 +00:00

integrations.py

style: apply ruff auto-fix

2026-03-15 04:10:28 +00:00

local_auth.py

fix(i18n): register _ in all Jinja2 template instances, sync translation files, fix pipelines.html

2026-03-12 12:46:11 +00:00

logs.py

feat(security): add comprehensive input validation and sanitization (#172)

2026-02-22 16:02:00 +00:00

mobile.py

feat(mobile): add iOS/Android mobile app with SSO login, camera upload, and push notifications

2026-03-10 09:52:02 +00:00

notifications.py

perf(api): fix n+1 query issue in user notification preferences update

2026-03-16 09:20:41 +00:00

onboarding.py

feat(notifications): admin push notifications and webhooks for user signup, plan changes, and payment issues

2026-03-07 20:15:39 +00:00

onedrive.py

Merge pull request #714 from christianlouis/perf/async-onedrive-token-refresh-7215258063318287629

2026-03-16 12:15:39 +01:00

openai.py

fix(api): swap parameter order in test_ai_extraction to fix 500 error

2026-02-23 21:35:36 +00:00

pipelines.py

feat(ocr): add multi-language OCR support with per-pipeline language override

2026-03-08 21:47:12 +00:00

plans.py

perf(api): optimize reorder_plans to prevent N+1 queries

2026-03-16 09:19:50 +00:00

process.py

Apply Black and isort formatting to modified files

2026-02-07 15:00:18 +00:00

profile.py

feat(profile): expose default_document_language in profile API and UI

2026-03-16 12:13:54 +00:00

qr_auth.py

fix(qr-login): render QR code server-side using segno instead of CDN JS library

2026-03-18 08:34:22 +00:00

queue.py

refactor(queue): address code review feedback — extract constants and sync refresh interval

2026-02-27 00:47:58 +00:00

routing_rules.py

refactor(routing): address code review feedback - simplify list filter, fix docs example

2026-03-09 23:38:25 +00:00

saved_searches.py

fix(security): address CodeQL clear-text logging and weak hashing alerts

2026-03-08 19:33:55 +00:00

scheduled_jobs.py

fix: code standards audit — 100% coverage, Pydantic v2 model_config, asyncio.run(), targeted edge-case tests

2026-03-09 19:00:13 +00:00

search.py

feat(search): add content-finding filters, saved searches, and text quality to Search view

2026-03-01 13:46:15 +00:00

sessions.py

feat(auth): add server-side session management and QR code login backend

2026-03-16 22:29:04 +00:00

settings.py

feat(settings): add dynamic autocomplete for AWS/Azure regions, OCR langs, and embedding models

2026-03-05 22:00:22 +00:00

shared_links.py

⚡ fix N+1 query in list_shared_links

2026-03-16 09:14:36 +00:00

similarity.py

fix(similarity): address code review - column-only queries, configurable batch size, WCAG touch targets

2026-03-02 13:39:10 +00:00

subscriptions.py

feat(subscriptions): add subscription change management with upgrade/downgrade scheduling

2026-03-07 20:14:12 +00:00

system_reset.py

feat(system-reset): add system reset and factory reset feature

2026-03-16 22:26:17 +00:00

translation.py

fix(translation): fix apply_owner_filter called with wrong arguments

2026-03-16 15:25:29 +00:00

url_upload.py

perf: optimize url upload with async i/o

2026-03-16 09:53:47 +00:00

user.py

feat(profile): add user self-service profile settings page and API

2026-03-12 13:00:19 +00:00

webhooks.py

feat(webhooks): add webhook support for external integrations

2026-03-01 20:42:57 +00:00