Jakub Zych 633d45082e fix(19.7): RB-IN-01 the My account URL check refuses control characters ...

Browsers strip tab and newline from URLs, so "/\t/host" passed the
SPA's same-origin check and resolved off-site. The check now refuses any
ASCII control character first, as Go's url.Parse does on the server, and
an absolute URL must parse with a host, so both sides apply one rule.

2026-10-23 20:31:28 +02:00

..

openapi

fix(cabana): safe account action URLs, per-section isolation and the prompted record action contract (B-WR-03, B-WR-05, B-WR-06)

2026-10-23 16:24:34 +02:00

public

fix(admin): add favicon and page-aware titles

2026-10-07 10:39:22 +02:00

src

fix(19.7): RB-IN-01 the My account URL check refuses control characters

2026-10-23 20:31:28 +02:00

tests

fix(19.7): RB-IN-01 the My account URL check refuses control characters

2026-10-23 20:31:28 +02:00

env.d.ts

feat(10-01): serve the embedded admin SPA at backend.uri with cookie login

2026-09-27 15:21:48 +02:00

index.html

fix(admin): add favicon and page-aware titles

2026-10-07 10:39:22 +02:00

package-lock.json

fix(admin): sanitize the richeditor read-only display with DOMPurify (T-10-16)

2026-10-12 20:35:57 +02:00

package.json

fix(admin): sanitize the richeditor read-only display with DOMPurify (T-10-16)

2026-10-12 20:35:57 +02:00

tsconfig.json

feat(10-01): serve the embedded admin SPA at backend.uri with cookie login

2026-09-27 15:21:48 +02:00

vite.config.ts

feat(10.1-02): run registered toolbar actions and scope plugin CSS per controller

2026-09-29 02:13:26 +02:00

vitest.browser.config.ts

test(19.6.1-03): SPA trigger, record lock and footer wrap tests

2026-10-22 12:18:34 +02:00

vitest.config.ts

fix(admin): sanitize the richeditor read-only display with DOMPurify (T-10-16)

2026-10-12 20:35:57 +02:00