2 Commits

Author	SHA1	Message	Date
Jakub Zych	1bb89ce006	fix(17): T-17-15 refuse an unsafe frontend_url on save and import ... - Settings.BeforeValidate answers a cabana validation error on frontend_url, so the settings save is a 422 and the row is unchanged - sitemap:import-winter stops on a frontend_url that models.AllowedFrontendURL refuses, before the dry-run branch and before any database use; the value is printed quoted - errors.frontend_url phrase in en and pl - TestSettingsBeforeValidate, TestWinterSettingsFrontendURL and the save and import refusals in the Postgres smokes	2026-10-13 00:59:24 +02:00
Jakub Zych	b9804ddf17	fix(17): T-17-15 apply the frontend_url rewrite only for a safe http(s) URL ... - models.AllowedFrontendURL: empty, or an absolute http(s) URL with a host and without whitespace, control characters, a double quote, <, > or & - classes.Rewrite leaves the document unchanged for a refused value, inserts through EscapeText/EscapeAttr and keeps a loc or href that would not stay an http(s) URL - TestRewriteUnsafeFrontendURL, TestAllowedFrontendURL and a stored-row check in TestSitemapImportSmoke	2026-10-13 00:57:02 +02:00