fix: validate icon URL to prevent server-side request forgery (SSRF) - #1590

Open

bunlongheng wants to merge 459 commits into

linuxserver:masterfrom

bunlongheng:fix/ssrf-icon-url-fetch

This pull request is big! We're only showing the most recent 250 commits

Commits on Apr 19, 2023

Merge pull request #1150 from linuxserver/2.x-project
aptalca
authored
9c117b7

Commits on Apr 29, 2023

add search via select2 for application dropdown
TheDen
committed
427353b

Commits on May 16, 2023

fix sortable tooltip (#1130)
dairidong
authored
1f5493a

Commits on May 20, 2023

Remove register route (#1163)
KodeStar
authored
60facca

Commits on May 26, 2023

Add Trianglify (#1158)
ullbergm
authored
6e954a3
fix: Remove mix from trianglify.js (#1166)
keriati
authored
7d016cd

Commits on Jun 5, 2023

fix: validate icons to be images (#1167)
keriati
authored
5d67f57

Commits on Jun 6, 2023

fix: validate icons to be images (#1173)
keriati
authored
fbd050d

Commits on Aug 9, 2023

Update readme.md (#1186)
Eonloop
authored
d2184ee

Commits on Sep 26, 2023

Fix and add SVG support
fyutins
committed
431eafb

Commits on Nov 11, 2023

Merge pull request #1222 from fyutins/2.x
KodeStar
authored
768e7a6
Update app.php version
KodeStar
authored
2e96b7b

Commits on Feb 12, 2024

Merge pull request #1155 from TheDen/add-search-application-item
KodeStar
authored
ecb668a

Commits on Feb 16, 2024

Adopt short array syntax
laravel-shift
committed
51b30e5
Convert string references to `::class`
laravel-shift
committed
be93195
Move `resources/lang` folder
laravel-shift
committed
825ff6a
Shift registered middleware
laravel-shift
committed
aa72ce0
Streamline `$commands` property
laravel-shift
committed
2b602ce
Replace deprecated `HEADER_X_FORWARDED_ALL` constant
laravel-shift
committed
d41c4c8
Upgrade to Flysystem 3.0
laravel-shift
committed
72cd16a
Shift core files
laravel-shift
committed
6423ccd
Remove web.config
laravel-shift
committed
0f4b336
Remove unnecessary `$model` property
laravel-shift
committed
ad86e54
Convert route options to fluent methods
laravel-shift
committed
14b89ac
Adopt class based routes
laravel-shift
committed
42b5a29
Shift config files
laravel-shift
committed
ee3361d
Default config files
laravel-shift
committed
a6ae602
Bump Composer dependencies
laravel-shift
committed
04b8ede
Use `<env>` tags for configuration
laravel-shift
committed
4bfcd64
Adopt anonymous migrations
laravel-shift
committed
1c73cf0
Shift cleanup
laravel-shift
committed
0189965
Merge pull request #7 from KodeStar/shift-110367
KodeStar
authored
095aff8
Convert string references to `::class`
laravel-shift
committed
3188a8f
Remove explicit call to register policies
laravel-shift
committed
b943674
Shift core files
laravel-shift
committed
ef25ec4
Shift config files
laravel-shift
committed
5b4e14d
Default config files
laravel-shift
committed
854fb42
Bump Composer dependencies
laravel-shift
committed
e902b3a
Rename `password_resets` table
laravel-shift
committed
8725493
Add type hints for Laravel 10
laravel-shift
committed
2cb837e
Add type hints from DocBlocks
laravel-shift
committed
3487f52
Remove redundant typing from DocBlocks
laravel-shift
committed
f3a5be7
Merge pull request #8 from KodeStar/shift-110368
KodeStar
authored
22d7a59
Update dependencies
Chris Hunt
committed
d52ae0d
Update version
Chris Hunt
committed
ffb5b03
Merge pull request #1276 from KodeStar/2.x
KodeStar
authored
5e2c3a5
Update readme.md
KodeStar
authored
70f212c

Commits on Feb 17, 2024

Add Laravel 10 dependencies
KodeStar
authored
9fbb345
Update php version in CI tests
Chris Hunt
committed
2748945
Change to php 8.3
KodeStar
authored
2fea82c
Update ci.yml
KodeStar
authored
e7d5812
Update ci.yml
KodeStar
authored
39f2310
Merge pull request #1277 from KodeStar/2.x
KodeStar
authored
c69961b
Fix languages
Chris Hunt
committed
a0e5111
Merge pull request #1278 from KodeStar/bugfix/fix_language_dropdown
KodeStar
authored
379ba34
Unable to load apps after update to laravel 10
Chris Hunt
committed
5825858
Merge pull request #1280 from KodeStar/bugfix/unable_to_load_apps
KodeStar
authored
e9bfd9a
Add missing
Chris Hunt
committed
2899b7d
Merge pull request #1283 from KodeStar/bugfix/unable_to_load_apps
KodeStar
authored
23f3a9c
Add npm dependencies
laravel-shift
committed
8781dbc
Update build scripts
laravel-shift
committed
aa5a6fc
Configure Vite
laravel-shift
committed
3a3cea4
Remove `webpack.mix.js`
laravel-shift
committed
4430b21
Use ES modules
laravel-shift
committed
baf7131
Rename ENV variables
laravel-shift
committed
f3a4ac3
Add `.vue` extension to Vue imports
laravel-shift
committed
0f19e3c
Ignore build assets
laravel-shift
committed
c6c9ec1
Update vite
Chris Hunt
committed
029def9
Merge pull request #9 from KodeStar/shift-110402
KodeStar
authored
0de1e5b
Update ci.yml
KodeStar
authored
afc07ab
Merge pull request #1288 from KodeStar/2.x
KodeStar
authored
3a509fc
Revert "Replace Mix with Vite"
KodeStar
authored
36d1d55
Merge pull request #1289 from linuxserver/revert-1288-2.x
KodeStar
authored
d184427

Commits on Feb 18, 2024

Initial commit
Chris Hunt
committed
8fa870e
Updates
Chris Hunt
committed
a0726a4
Add alternate tag types
Chris Hunt
committed
d276bf8
Fix prettier complaints
Chris Hunt
committed
70252b7
Fix extra prettier complaints
Chris Hunt
committed
b7c0fd2
Merge pull request #1290 from KodeStar/feature/add_columns
KodeStar
authored
002bae3
Fix upload paths
Chris Hunt
committed
fb7f9de
Merge pull request #1291 from KodeStar/2.x
KodeStar
authored
809a997

Commits on Feb 19, 2024

Fix prettier complaints
Chris Hunt
committed
4b8bf51
Fix required fields and default items and tags to pinned
Chris Hunt
committed
09e4bb8
Add tags to application list, and fix home dashboard tag
Chris Hunt
committed
f3bc6ab
Fix empty title when creating
Chris Hunt
committed
599035b
Merge pull request #1293 from KodeStar/2.x
KodeStar
authored
9d0209c
Update version number
KodeStar
authored
c16a484

Commits on Mar 31, 2024

Update validation.php
KodeStar
authored
f405cf2

Commits on Apr 19, 2024

chore: fix some typos in comments
goodactive
committed
184e19a

Commits on Sep 27, 2024

Added Serbian translation
tremor021
committed
6188b1d

Commits on Nov 4, 2024

Merge pull request #1328 from goodactive/2.x
KodeStar
authored
07ea22d
Merge pull request #1372 from tremor021/2.x
KodeStar
authored
a497386
Throttle websitelookup's to 10 per minute to limit port scan effictiveness
Chris Hunt
committed
837f5c4
Merge pull request #1384 from linuxserver/feature/throttle_websitelookup
KodeStar
authored
026bcf9
Fixes #1386
Chris Hunt
committed
b880333
Update Spanish translations
dfernandezdaw
committed
18609fb

Commits on Nov 5, 2024

Update app.php
KodeStar
authored
1063d2c
Merge pull request #1387 from linuxserver/bugfix/search_category_tiles
KodeStar
authored
395c775
Search from URL fixed #1369
Chris Hunt
committed
c2a3368
Prettier fix
Chris Hunt
committed
8ba8f0c
Fix 2 dots that are visible on light backgrounds #1383
Chris Hunt
committed
5ccb87c
Merge pull request #1390 from linuxserver/feature/search_from_url
KodeStar
authored
014f054
Merge branch '2.x' into bugfix/two_dots
KodeStar
authored
8f360f9
Merge pull request #1391 from linuxserver/bugfix/two_dots
KodeStar
authored
2b43760
Merge pull request #1388 from dfernandezdaw/2.x
KodeStar
authored
f820c0b
Allow ico images fixes #1357
Chris Hunt
committed
be59ac7
Merge pull request #1392 from linuxserver/bugfix/allow_ico_images
KodeStar
authored
b90b38e

Commits on Apr 25, 2025

Add warp on userlist
riv-gh
committed
e9d5614

Commits on May 5, 2025

fixed some rebase conflicts

tkolzer
authored and
knom
committed
c56ffe1
hide switchuser when auth_role is used

tkolzer
authored and
knom
committed
d146fed
fixed some rebase conflicts

tkolzer
authored and
knom
committed
921631b
added missing variable to example env

tkolzer
authored and
knom
committed
f7de56b
changed naming of property

tkolzer
authored and
knom
committed
c08b0bf
disabled users, items, tags for non admin users and user and login forms for all users

tkolzer
authored and
knom
committed
808c41a
updated supportedapps

tkolzer
authored and
knom
committed
041ec42
Update readme.md

tkolzer
authored and
knom
committed
dff3f90
small

tkolzer
authored and
knom
committed
65a6ad5
corrected some spelling mistakes

tkolzer
authored and
knom
committed
3cbbf80
added ENV variable for the auth roles delimiter

tkolzer
authored and
knom
committed
2e5d745
fixed some typos

tkolzer
authored and
knom
committed
c71479f
added AUTH_ROLES_DELIMITER to example env file

tkolzer
authored and
knom
committed
55d3766
renamed "controles" to "controls"
knom
committed
5950ca9

Commits on Jul 10, 2025

Merge pull request #1454 from knom/2.x
KodeStar
authored
749442e
Merge pull request #1453 from riv-gh/bugfix/userlist-wrap
KodeStar
authored
11453e1
Apply code style
laravel-shift
committed
c1c3888
Slim `lang` files
laravel-shift
committed
b3cdc57
Remove default `app` files
laravel-shift
committed
b9e75b9
Shift core files
laravel-shift
committed
7153a41
Streamline config files
laravel-shift
committed
48e16eb
Set new `ENV` variables
laravel-shift
committed
1fb6f75
Default new `bootstrap/app.php`
laravel-shift
committed
474059e
Re-register HTTP middleware
laravel-shift
committed
42d29f0
Consolidate service providers
laravel-shift
committed
9091d1d
Re-register service providers
laravel-shift
committed
8554861
Re-register routes
laravel-shift
committed
f5ddd93
Bump Composer dependencies
laravel-shift
committed
7bb0a7c
Adopt anonymous migrations
laravel-shift
committed
53f28b5
Adopt Laravel type hints
laravel-shift
committed
968a582
Remove `createApplication` method
laravel-shift
committed
f0ce9d6
Merge pull request #13 from KodeStar/shift-154023
KodeStar
authored
ecc54b6
Swap dependency
laravel-shift
committed
e251f4f
Convert `Form` facade
laravel-shift
committed
638d2fe
Merge pull request #14 from KodeStar/shift-154026
KodeStar
authored
d972cbc

Commits on Jul 11, 2025

Updates to vendors etc
Chris Hunt
committed
8fb6438
Fix forms on enhanced apps
Chris Hunt
committed
f197aeb
Throw error if image doesn't have an extension #1446
Chris Hunt
committed
22f66d3
Update cache version
Chris Hunt
committed
d1801d1
Merge pull request #1464 from KodeStar/2.x
KodeStar
authored
abbc78e

Commits on Jul 13, 2025

Fix uploads and displaying of malicious SVG files
Chris Hunt
committed
2df5847
Merge pull request #1466 from KodeStar/2.x
KodeStar
authored
0388ee9
Fixes to reduce the SSRF attack vector.
Chris Hunt
committed
69bc8cb

Commits on Jul 14, 2025

Merge pull request #1467 from KodeStar/2.x
KodeStar
authored
53fd624

Commits on Jul 15, 2025

Add tests and fix user edit form
Chris Hunt
committed
1e6b1f6
Merge pull request #1469 from KodeStar/2.x
KodeStar
authored
4fa41d8

Commits on Jul 17, 2025

Fix importing apps and logging in
Chris Hunt
committed
6075dcc
Merge pull request #1470 from KodeStar/2.x
KodeStar
authored
abe08a7
Add cache table
Chris Hunt
committed
0d90170
Merge pull request #1471 from KodeStar/2.x
KodeStar
authored
57e0a33

Commits on Jul 21, 2025

Add misisng input type in the form builder
Chris Hunt
committed
08b8ab6
Merge pull request #1473 from KodeStar/2.x
KodeStar
authored
e42f78b
Fixed multiple typos (German translation)
micvog
authored
31db31d

Commits on Jul 22, 2025

Load in configs values if class has been lost
Chris Hunt
committed
a8e4ab4
Add missing variable
Chris Hunt
committed
41aa255
Merge pull request #1476 from KodeStar/2.x
KodeStar
authored
1ccc0da

Commits on Jul 24, 2025

Escape search queries and add setting value on edit
Chris Hunt
committed
d1a96dd
Merge pull request #1477 from KodeStar/2.x
KodeStar
authored
6b9f61b

Commits on Jul 31, 2025

feat(icon-upload): proxy management
Nyuwb
authored
dce37c1

Commits on Aug 2, 2025

Fix for some enhanced apps not working
Chris Hunt
committed
fd926e9
Redirect to search provider without error fixes #1482
Chris Hunt
committed
63e777b
Update search test
Chris Hunt
committed
cd95fc3
Merge pull request #1483 from KodeStar/2.x
KodeStar
authored
31ca05f

Commits on Aug 23, 2025

Delete SECURITY.md
thespad
authored
7d93099
Merge pull request #1488 from linuxserver/inherit-security-md
thespad
authored
ad4584e

Commits on Sep 10, 2025

Merge pull request #1475 from micvog/fix-german-translation
KodeStar
authored
05a552f
Merge pull request #1480 from Nyuwb/patch-1
KodeStar
authored
825f67a
Update items with no password
Chris Hunt
committed
517f51b
Merge pull request #1496 from KodeStar/bugfix/update_proxy_and_items_with_no_password
KodeStar
authored
c9ea2cd

Commits on Sep 11, 2025

Update app.php
webmogul1
authored
eadd9d1

Commits on Sep 15, 2025

Add current background maxsize #1501
Chris Hunt
committed
31f1ba8
Update application version to 2.7.6
KodeStar
authored
54cf2b8
Merge pull request #1499 from webmogul1/patch-1
KodeStar
authored
966279b
Merge pull request #1503 from KodeStar/background_max_file_size
KodeStar
authored
ae4ce92
Add password field
Chris Hunt
committed
6d12c54
Add password field to fix #1498
KodeStar
authored
32bf1d0

Commits on Sep 16, 2025

Fix tag list url when tags are treated as tags
Chris Hunt
committed
755c3e5
Merge pull request #1507 from KodeStar/taglist
KodeStar
authored
045bdf0

Commits on Nov 11, 2025

Add autocomplete suggestions support and added to bing, duckduckgo, and google
Chris Hunt
committed
852c231
Fix lint issues
Chris Hunt
committed
4f30332
Merge pull request #1523 from KodeStar/add_autocomplete_suggestions
KodeStar
authored
900fc83
Remove search provider dropdown when there's only a single provider
Chris Hunt
committed
130661b
Fix lint issue
Chris Hunt
committed
66dfe95
Merge pull request #1524 from KodeStar/remove_dropdown_on_single_provider
KodeStar
authored
7861ae1

Commits on Apr 22, 2026

Commits on May 13, 2026

fix: proxy options in ItemController
Nyuwb
authored
6a776e3

Commits on Jul 8, 2026

Merge pull request #1563 from Nyuwb/patch-1
KodeStar
authored
df0eba0
Merge pull request #1559 from JoshSalway/queue-safety-2026-04-22
KodeStar
authored
5907a1f
Include tags in item export and restore them on import
KodeStar
committed
fb9af1b
Harden against host header injection and open redirect
KodeStar
committed
881533b
Return graceful output from get_stats instead of a 500
KodeStar
committed
f547ae4
Fix CI: pin Node 24 and install frontend deps with npm ci
KodeStar
committed
5247349
Merge pull request #1571 from linuxserver/fix/ci-node-select2
KodeStar
authored
e2215fe
Merge branch '2.x' into fix/getstats-graceful-failure
KodeStar
committed
d1c52b8
Merge branch '2.x' into fix/host-header-injection
KodeStar
committed
5dcf462
Merge branch '2.x' into fix/export-import-tags
KodeStar
committed
ec229ea
Update dependencies flagged by security advisories and require PHP 8.4
KodeStar
committed
f69cbba
Add a configurable default tag for the dashboard
KodeStar
committed
c0c202c
Enforce TRUSTED_HOSTS allow-list regardless of APP_ENV
KodeStar
committed
9a9877a
Only offer pinned tags as the default tag
KodeStar
committed
ad9baff
Merge pull request #1570 from linuxserver/fix/getstats-graceful-failure
KodeStar
authored
0763484
Merge pull request #1568 from linuxserver/fix/host-header-injection
KodeStar
authored
a1f0d8f
Merge pull request #1567 from linuxserver/fix/export-import-tags
KodeStar
authored
caa4f39
Merge pull request #1572 from linuxserver/feature/default-tag-group
KodeStar
authored
6d0242d
Merge pull request #1569 from linuxserver/chore/security-dependency-updates
KodeStar
authored
cb59689
Upgrade to Laravel 12
KodeStar
committed
3919188
Upgrade to Laravel 13
KodeStar
committed
8a62254
Remediate npm build-toolchain vulnerabilities via overrides
KodeStar
committed
9cfa254
Add upgrade-regression test coverage
KodeStar
committed
46e09d1
Fix appload() returning a coerced HTTP 200 instead of a 404
KodeStar
committed
f1eec81
Bump version to 2.8.0
KodeStar
committed
25d1dc3
Fix committed PHPUnit vendor path casing for case-sensitive CI
KodeStar
committed
13642d5

Commits on Jul 9, 2026

Fix import status regression from appload 404 + tighten upgrade tests
KodeStar
committed
6f93291
Merge pull request #1574 from linuxserver/chore/laravel-13-upgrade
KodeStar
authored
49c29c8
Run tests against in-memory sqlite and refuse real databases
KodeStar
committed
2555ab1
Fix silent tile disappearance and ownership-reassignment bugs
KodeStar
committed
1c7ae3e
Merge pull request #1575 from linuxserver/chore/laravel-13-upgrade
KodeStar
authored
3f483c9
Add WebSocket support for TrueNAS JSON-RPC 2.0 API

jaycollett
authored and
KodeStar
committed
93a321f
Add global TLS verification skip setting

jaycollett
authored and
KodeStar
committed
bdf9160
Fix checkbox config values always returning "1"

jaycollett
authored and
KodeStar
committed
57fa9f2
Vendor phrity/websocket dependency and fix v3 exception namespace
KodeStar
committed
d16b7f6
Merge pull request #1576 from linuxserver/feat/global-tls-skip
KodeStar
authored
667dd4c
Merge pull request #1577 from linuxserver/fix/checkbox-test-config
KodeStar
authored
55bda9d
Merge pull request #1578 from linuxserver/feat/truenas-websocket-client
KodeStar
authored
1f7432f
Automate bumping version
KodeStar
committed
a38ecd4
Update CI
KodeStar
committed
327af60
Bump version to 2.8.1
github-actions[bot]
committed
6a45d44
Merge pull request #1579 from linuxserver/release/v2.8.1
KodeStar
authored
8fc5f3c

Commits on Jul 10, 2026

Update German translation
tuxinaut
committed
2ceec61
Merge pull request #1580 from tuxinaut/chore/de-language-update
KodeStar
authored
62823ae

Commits on Aug 3, 2026

Fix inconsistent SVG tile icon sizes
KodeStar
committed
91f7a2e
Merge pull request #1583 from linuxserver/fix/app-icon-consistent-size
KodeStar
authored
238452c

Commits on Aug 8, 2026

Pin session cookie name, stop deriving it from APP_NAME
pilotso11
committed
0620ec2

Commits on Aug 12, 2026

Merge pull request #1585 from pilotso11/fix/session-cookie-appname-dot
KodeStar
authored
0cae68c
Bump version to 2.8.2
github-actions[bot]
committed
ee30662
Merge pull request #1587 from linuxserver/release/v2.8.2
KodeStar
authored
40e3f17

Commits on Aug 21, 2026

fix: validate icon URL to prevent server-side request forgery
bunlongheng
committed
0124b77