Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Security fixes: P0-P2 complete (22 fixes)

Browse Source 
P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed
This commit is contained in:
Agent Zero
2026-07-25 21:03:46 +02:00
parent aaa7406929
commit 727d86614e
103 changed files with 6831 additions and 1053 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/components/comm/blocks/ActionCardBlock.tsx
+9 -2
View File
@@ -23,8 +23,15 @@ const ActionCardBlock: React.FC<ActionCardBlockProps> = ({ block }) => {
// Frontend handles dismiss — no-op here, parent component can wire up
return;
}
// Treat as URL
window.open(action.action, '_blank', 'noopener,noreferrer');
// Validate URL — only allow http: and https: protocols to prevent javascript: URLs
const url = action.action;
try {
const parsed = new URL(url);
if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return;
} catch {
return; // Invalid URL
}
window.open(url, '_blank', 'noopener,noreferrer');
};
return (