Proudlock 31c616abef Fix critical XSS vulnerabilities in operator report email alerts ...

SECURITY FIXES:
- Escape all user-controlled values (hostname, reason, details) to prevent XSS
- Fix endpoint name from 'assets.detail' to 'assets.get_asset'
- Fix fallback URL to be absolute instead of relative path
- Remove render_email() to avoid subject duplication in email body
- Check recipients exist before expensive HTML generation
- Build email template directly with proper escaping throughout

2026-09-09 09:10:43 -04:00

..

__init__.py

Import the wilm agent store, WINC adoption work and batches CLI, with four fixes

2026-09-03 08:16:38 -04:00

adoption.py

Merge the wilm delivery work into main

2026-08-30 19:41:15 -04:00

agentstore.py

Import the wilm agent store, WINC adoption work and batches CLI, with four fixes

2026-09-03 08:16:38 -04:00

agentupload.py

Fix user-context collection, split agent log destinations, widen upload cap

2026-09-05 14:20:07 -04:00

monitors.py

Merge the wilm work, act on the five-agent review, verify the launch-path policy on Windows

2026-09-02 16:15:53 -04:00

routes.py

Fix critical XSS vulnerabilities in operator report email alerts

2026-09-09 09:10:43 -04:00

siteagent.py

Spread agent first contact with startup jitter

2026-09-06 18:08:46 -04:00