fix: validate icon URL to prevent server-side request forgery (SSRF)

.env.example

@@ -4,16 +4,44 @@ APP_KEY=
 APP_DEBUG=false
 APP_URL=http://localhost
 
+# Security: Host Header Injection / Open Redirect hardening (CVE-2025-50578).
+# TRUSTED_PROXIES: comma-separated CIDRs/IPs of reverse proxies allowed to set
+#   X-Forwarded-* headers. Defaults to the private ranges below when unset. Use
+#   "*" to trust all proxies (only behind a trusted network boundary).
+#TRUSTED_PROXIES=192.168.0.0/16,172.16.0.0/12,10.0.0.0/8,127.0.0.1
+# TRUSTED_HOSTS: comma-separated hostnames Heimdall is allowed to serve. Unset
+#   means no restriction (default, backward compatible). Set this to your own
+#   domain to fully prevent host-header injection / open redirects.
+#TRUSTED_HOSTS=heimdall.example.com
+
+APP_LOCALE=en
+APP_FALLBACK_LOCALE=en
+APP_FAKER_LOCALE=en_US
+APP_MAINTENANCE_DRIVER=file
+APP_MAINTENANCE_STORE=database
+BCRYPT_ROUNDS=12
+
 LOG_CHANNEL=daily
+LOG_STACK=single
 
 DB_CONNECTION=sqlite
 DB_DATABASE=app.sqlite
 
-BROADCAST_DRIVER=log
-CACHE_DRIVER=file
+#DB_CONNECTION=<mysql | pgsql>
+#DB_HOST=<hostname | ip>
+#DB_PORT=<port number>
+#DB_DATABASE=<database>
+#DB_USERNAME=<user>
+#DB_PASSWORD=<password>
+
+BROADCAST_CONNECTION=log
+CACHE_STORE=file
 QUEUE_CONNECTION=sync
 SESSION_DRIVER=file
 SESSION_LIFETIME=120
+SESSION_ENCRYPT=false
+SESSION_PATH=/
+SESSION_DOMAIN=null
 QUEUE_DRIVER=sync
 
 REDIS_HOST=127.0.0.1
@@ -41,3 +69,11 @@ PUSHER_APP_CLUSTER=mt1
 
 MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
 MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
+
+AUTH_ROLES_ENABLE=false
+AUTH_ROLES_HEADER="remote-groups"
+AUTH_ROLES_HTTP_HEADER="HTTP_REMOTE_GROUPS"
+AUTH_ROLES_ADMIN="admin"
+AUTH_ROLES_DELIMITER=","
+
+ALLOW_INTERNAL_REQUESTS=false

.eslintignore

@@ -0,0 +1,3 @@
+huebee.js
+jquery-ui.min.js
+bootstrap.js

.eslintrc

@@ -0,0 +1,13 @@
+{
+    "extends": ["airbnb-base", "prettier"],
+    "plugins": ["prettier"],
+    "rules": {
+        "prettier/prettier": ["error"]
+    },
+    "env": {
+        "browser": true
+    },
+    "globals": {
+        "$": true
+    }
+}

.github/workflows/call_issue_pr_tracker.yml

@@ -0,0 +1,16 @@
+name: Issue & PR Tracker
+
+on:
+  issues:
+    types: [opened,reopened,labeled,unlabeled,closed]
+  pull_request_target:
+    types: [opened,reopened,review_requested,review_request_removed,labeled,unlabeled,closed]
+  pull_request_review:
+    types: [submitted,edited,dismissed]
+
+jobs:
+  manage-project:
+    permissions:
+      issues: write
+    uses: linuxserver/github-workflows/.github/workflows/issue-pr-tracker.yml@v1
+    secrets: inherit

.github/workflows/call_issues_cron.yml

@@ -0,0 +1,13 @@
+name: Mark stale issues and pull requests
+on:
+  schedule:
+    - cron:  '35 15 * * *'
+  workflow_dispatch:
+
+jobs:
+  stale:
+    permissions:
+      issues: write
+      pull-requests: write
+    uses: linuxserver/github-workflows/.github/workflows/issues-cron.yml@v1
+    secrets: inherit

.github/workflows/ci.yml

@@ -0,0 +1,59 @@
+name: Tests (PHP)
+
+on: [pull_request]
+
+jobs:
+  tests:
+    name: Run tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+
+      - name: Setup PHP, with composer and extensions
+        uses: shivammathur/setup-php@v2 #https://github.com/shivammathur/setup-php
+        with:
+          php-version: '8.4'
+          extensions: mbstring, dom, fileinfo, mysql, libxml, xml, xmlwriter, dom, tokenizer, filter, json, phar, pcre, openssl, pdo, intl, curl
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v4
+        with:
+          path: vendor
+          key: composer-${{ hashFiles('composer.lock') }}
+
+      #- name: Run composer install
+      #  run: composer install -n --prefer-dist
+      #  env:
+      #    APP_ENV: testing
+
+      - name: Prepare Laravel Application
+        run: |
+          cp .env.example .env
+          php artisan key:generate
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: 'npm'
+
+      - name: Install node modules and build assets
+        run: npm ci && npm run dev
+
+      - name: Run ESLint
+        run: npm run lint
+
+      - name: Run tests
+        run: php artisan test
+        env:
+          APP_ENV: testing
+
+      - name: Php code sniffer
+        run: ./vendor/bin/phpcs --config-set ignore_warnings_on_exit 1
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@master
+        if: failure()
+        with:
+          name: Logs
+          path: ./storage/logs

.github/workflows/release.yml

@@ -0,0 +1,97 @@
+name: Release
+
+# Stage 1 of the release flow: opens a version-bump PR against 2.x.
+# When that PR is merged, tag-release.yml (stage 2) creates the tag and
+# the GitHub release automatically.
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: 'Version bump type'
+        required: true
+        default: 'patch'
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+      version:
+        description: 'Explicit version (e.g. 2.9.0) — overrides bump type'
+        required: false
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-pr:
+    name: Open version bump PR
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: 2.x
+          fetch-depth: 0
+          # Optional: set a RELEASE_TOKEN repo secret (fine-grained PAT with
+          # contents + pull-requests write) so the bump PR triggers CI checks.
+          # PRs created with the default github.token do not trigger workflows.
+          token: ${{ secrets.RELEASE_TOKEN || github.token }}
+
+      - name: Determine new version
+        id: version
+        env:
+          EXPLICIT_VERSION: ${{ inputs.version }}
+          BUMP: ${{ inputs.bump }}
+        run: |
+          current=$(sed -nE "s/^[[:space:]]*'version' => '([0-9]+\.[0-9]+\.[0-9]+)',/\1/p" config/app.php)
+          if [ -z "$current" ]; then
+            echo "::error::Could not read current version from config/app.php"
+            exit 1
+          fi
+          if [ -n "$EXPLICIT_VERSION" ]; then
+            new="$EXPLICIT_VERSION"
+            if ! echo "$new" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+              echo "::error::Invalid version '$new' — expected X.Y.Z"
+              exit 1
+            fi
+          else
+            IFS=. read -r major minor patch <<< "$current"
+            case "$BUMP" in
+              major) new="$((major + 1)).0.0" ;;
+              minor) new="$major.$((minor + 1)).0" ;;
+              patch) new="$major.$minor.$((patch + 1))" ;;
+            esac
+          fi
+          if git rev-parse -q --verify "refs/tags/v$new" > /dev/null; then
+            echo "::error::Tag v$new already exists"
+            exit 1
+          fi
+          echo "Bumping $current -> $new"
+          echo "new=$new" >> "$GITHUB_OUTPUT"
+
+      - name: Push bump commit to release branch
+        env:
+          NEW_VERSION: ${{ steps.version.outputs.new }}
+        run: |
+          sed -i -E "s/^([[:space:]]*'version' => ')[0-9.]+(',)/\1$NEW_VERSION\2/" config/app.php
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -am "Bump version to $NEW_VERSION"
+          git push --force origin "HEAD:refs/heads/release/v$NEW_VERSION"
+
+      - name: Open pull request
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_TOKEN || github.token }}
+          NEW_VERSION: ${{ steps.version.outputs.new }}
+        run: |
+          existing=$(gh pr list --head "release/v$NEW_VERSION" --base 2.x --state open --json number -q '.[0].number')
+          if [ -n "$existing" ]; then
+            echo "PR #$existing is already open for release/v$NEW_VERSION"
+          else
+            gh pr create \
+              --base 2.x \
+              --head "release/v$NEW_VERSION" \
+              --title "Bump version to $NEW_VERSION" \
+              --body "Automated version bump. Merging this PR will tag v$NEW_VERSION and publish the GitHub release. Merge it last, once everything for the release is on 2.x."
+          fi

.github/workflows/tag-release.yml

@@ -0,0 +1,41 @@
+name: Tag and release
+
+# Stage 2 of the release flow: whenever the version in config/app.php changes
+# on 2.x (normally by merging the PR opened by release.yml, but a hand-made
+# bump PR works too), create the matching tag and GitHub release.
+on:
+  push:
+    branches:
+      - 2.x
+    paths:
+      - config/app.php
+
+permissions:
+  contents: write
+
+jobs:
+  tag-release:
+    name: Tag and publish release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Create release if version is untagged
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          version=$(sed -nE "s/^[[:space:]]*'version' => '([0-9]+\.[0-9]+\.[0-9]+)',/\1/p" config/app.php)
+          if [ -z "$version" ]; then
+            echo "::error::Could not read version from config/app.php"
+            exit 1
+          fi
+          if git rev-parse -q --verify "refs/tags/v$version" > /dev/null; then
+            echo "Tag v$version already exists — nothing to do"
+            exit 0
+          fi
+          gh release create "v$version" \
+            --target "$GITHUB_SHA" \
+            --title "v$version" \
+            --generate-notes

.github/workflows/tag-version-check.yml

@@ -0,0 +1,26 @@
+name: Tag version check
+
+# Safety net for manually pushed tags: fails if the tag doesn't match the
+# version in config/app.php. Tags created by tag-release.yml use GITHUB_TOKEN
+# and therefore don't trigger this (they always match anyway).
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  check:
+    name: Tag matches config/app.php
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Compare tag with app version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          version=$(sed -nE "s/^[[:space:]]*'version' => '([0-9]+\.[0-9]+\.[0-9]+)',/\1/p" config/app.php)
+          if [ "$tag" != "$version" ]; then
+            echo "::error::Tag v$tag does not match config/app.php version $version — bump the version (or use the Release workflow, which does it for you)"
+            exit 1
+          fi
+          echo "Tag v$tag matches config/app.php"

.gitignore

@@ -3,6 +3,7 @@
 /public/hot
 /public/storage
 /storage/*.key
+/storage/debugbar
 /.idea
 /.vagrant
 Homestead.json
@@ -27,3 +28,5 @@ yarn-error.log
 .VolumeIcon.icns
 storage/app/public/avatars/*
 .env
+.phpunit.result.cache
+/.phpunit.cache