plane/apps
Nikhil 6d3d9e6df7
[WEB-4943]: add url has allowed host or scheme for validating valid redirections (#7809)
* feat: enhance path validation and URL safety in path_validator.py

* Added get_allowed_hosts function to retrieve allowed hosts from settings.
* Updated get_safe_redirect_url to validate URLs against allowed hosts.
* Improved URL construction logic for safer redirection handling.

* feat: enhance URL validation in authentication views

* Added url_has_allowed_host_and_scheme checks in SignUpAuthSpaceEndpoint and MagicSignInSpaceEndpoint for safer redirection.
* Updated redirect logic to fallback to base host if the constructed URL is not allowed.
* Improved overall URL safety and handling in authentication flows.

* fix: improve host extraction in get_allowed_hosts function

* Updated get_allowed_hosts to extract only the host from ADMIN_BASE_URL and SPACE_BASE_URL settings for better URL validation.
* Enhanced overall safety and clarity in allowed hosts retrieval.
2025-09-16 21:37:08 +05:30
..
admin [WEB-4840] chore: icon migration from @plane/ui to @plane/propel/icons (#7721) 2025-09-04 14:44:53 +05:30
api [WEB-4943]: add url has allowed host or scheme for validating valid redirections (#7809) 2025-09-16 21:37:08 +05:30
live [WEB-4810] feat: migrate to tsdown from tsup (#7679) 2025-09-03 14:01:57 +05:30
proxy [INFRA-219] fix: update Dockerfile and docker-compose for proxy service (#7523) 2025-07-31 13:27:34 +05:30
space Potential fix for code scanning alert no. 646: Server-side request forgery (#7758) 2025-09-10 14:42:46 +05:30
web [WEB-4885] feat: new filters architecture and UI components (#7802) 2025-09-16 21:15:08 +05:30