2 Commits

Author	SHA1	Message	Date
Jakub Zych	b9804ddf17	fix(17): T-17-15 apply the frontend_url rewrite only for a safe http(s) URL ... - models.AllowedFrontendURL: empty, or an absolute http(s) URL with a host and without whitespace, control characters, a double quote, <, > or & - classes.Rewrite leaves the document unchanged for a refused value, inserts through EscapeText/EscapeAttr and keeps a loc or href that would not stay an http(s) URL - TestRewriteUnsafeFrontendURL, TestAllowedFrontendURL and a stored-row check in TestSitemapImportSmoke	2026-10-13 00:57:02 +02:00
Jakub Zych	4e55939a1f	test(17-06): sitemap parity unit tests ... - TestURLTo (every Url::to golden case, BackendURL, URLPath), TestXMLEscaping (PHP XmlEscapingTest as behaviour), TestTiers (each default rule, first match, off, bad pattern fails Boot), TestRewrite, TestHooks, TestURLCap, TestManifest (fail-safe reads, key normalization, dates), TestFillable (PHP MassAssignmentTest), TestDefinitionItemJSON, TestBackendURL (trusted forwarded proto) - TestImportWinter on Postgres: maps and drops with report, --theme, --dry-run, --force, settings upsert, refusals	2026-10-12 19:38:04 +02:00