-
Notifications
You must be signed in to change notification settings - Fork 40
Pull requests: enonic/xp
Author
Label
Projects
Milestones
Reviews
Assignee
Sort
Pull requests list
Require the admin role for thread, deadlock and server dumps behind a statistics vhost
#12339
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Validate redirects, bound size and set timeouts when downloading an application
#12338
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Encode the string path of apiUrl like every other URL builder
#12337
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Reject cross-origin state-changing universal API calls from session users
#12336
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Serve only resources under the assets folder from the asset endpoint
#12335
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Check access and validate input in the admin extension icon endpoint
#12334
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Honour Forwarded headers per connector and only from trusted proxies
#12333
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Build the rich-text sanitizer policy per document instead of mutating a shared builder
#12332
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Stop parsing multipart bodies for every request
#12331
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Bound the size arguments of the blur, block, border and rounded image filters
#12330
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Return only the reason phrase for 5xx responses outside dev mode
#12329
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Fix suffix byte ranges and cap the number of ranges in an attachment request
#12328
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Answer malformed image, component and id provider input with 400 instead of 500
#12327
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Define a __proto__ key as an own property when converting host values to JS objects
#12326
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Answer unknown HTTP methods with 405 and ignore malformed Content-Type instead of failing with 500
#12325
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Require the admin role for snapshot, restore, reindex, audit log cleanup and export/import tasks
#12324
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Reject line breaks in mail headers, content type and attachment fields
#12323
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Limit the size of request bodies read into memory and read API bodies after access checks
#12322
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Enforce READ permission on request content in controller mappings and portal.getContent()
#12321
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Honour api.index.enabled for the /api/ path as well
#12320
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Reject unmatched hosts on management and statistics connectors that have vhost mappings
#12319
opened Sep 5, 2026 by
rymsha
Contributor
Loading…
Bump @humanfs/node from 0.16.7 to 0.16.8 in /modules/lib
dependencies
Pull requests that update a dependency file
javascript
Pull requests that update Javascript code
#12317
opened Sep 3, 2026 by
dependabot
Bot
Loading…
Bump tika from 3.3.2 to 4.0.0
dependencies
Pull requests that update a dependency file
java
Pull requests that update Java code
#12307
opened Aug 31, 2026 by
dependabot
Bot
Loading…
Bump com.networknt:json-schema-validator from 2.0.0 to 3.0.7
dependencies
Pull requests that update a dependency file
java
Pull requests that update Java code
#12290
opened Aug 24, 2026 by
dependabot
Bot
Loading…
Previous Next
ProTip!
Follow long discussions with comments:>50.