Proudlock 31c616abef Fix critical XSS vulnerabilities in operator report email alerts ...

SECURITY FIXES:
- Escape all user-controlled values (hostname, reason, details) to prevent XSS
- Fix endpoint name from 'assets.detail' to 'assets.get_asset'
- Fix fallback URL to be absolute instead of relative path
- Remove render_email() to avoid subject duplication in email body
- Check recipients exist before expensive HTML generation
- Build email template directly with proper escaping throughout

2026-09-09 09:10:43 -04:00

..

api

Fix critical XSS vulnerabilities in operator report email alerts

2026-09-09 09:10:43 -04:00

frontend

Hard delete applications, nest installer packages, detect PE versions

2026-09-07 15:04:21 -04:00

migrations

Add endpoint locks and split endpoints.deploy into three grants

2026-09-07 12:36:45 -04:00

models

Add endpoint locks and split endpoints.deploy into three grants

2026-09-07 12:36:45 -04:00

services

Cache endpoint health as a ranked rollup

2026-09-07 05:17:19 -04:00

__init__.py

add endpoints plugin with fleet list view and monitoring drafts

2026-08-27 05:41:06 -04:00

ADOPTION-TOOL-SPIKE.md

Merge the wilm delivery work into main

2026-08-30 19:41:15 -04:00

AGENT-CONTRACT.md

Endpoint telemetry, PC Detail rework and a checked backup/restore path

2026-09-06 18:53:11 -04:00

commands.py

Add endpoint locks and split endpoints.deploy into three grants

2026-09-07 12:36:45 -04:00

DESIGN-DECISIONS-agent.md

harden CSV import reconciliation and preserve saved model selections

2026-08-28 09:29:09 -04:00

eventcatalog.py

Cache endpoint health as a ranked rollup

2026-09-07 05:17:19 -04:00

manifest.json

add endpoints plugin with fleet list view and monitoring drafts

2026-08-27 05:41:06 -04:00

plugin.py

Gate operator reports behind their own grant

2026-09-08 07:36:19 -04:00