decolua 0c7c9de00a fix(security): re-auth on DB export/import + SSRF guard on web fetch ... - /api/settings/database now requires current password (header for GET, body for POST) in addition to session; CLI-token requests exempt - add verifyDashboardPassword helper reusing login bcrypt check - profile UI prompts password via modal before export/import - /v1/web/fetch rejects internal/private/metadata targets via assertPublicUrl Refs GHSA-qvfm-67h2-2qfx, GHSA-qj3v-64wj-q825 Co-authored-by: Cursor <cursoragent@cursor.com>		2026-06-13 11:40:35 +07:00
..
app	fix(security): re-auth on DB export/import + SSRF guard on web fetch	2026-06-13 11:40:35 +07:00
i18n	Add multi-language support for UI	2026-03-17 09:30:07 +07:00
lib	fix(security): re-auth on DB export/import + SSRF guard on web fetch	2026-06-13 11:40:35 +07:00
mitm	fix(mitm): update Kiro API endpoint to runtime.us-east-1.kiro.dev	2026-06-08 09:43:45 +07:00
models	feat: add OpenCode Go provider and support for custom models	2026-04-22 14:16:21 +07:00
shared	fix(security): re-auth on DB export/import + SSRF guard on web fetch	2026-06-13 11:40:35 +07:00
sse	fix(security): re-auth on DB export/import + SSRF guard on web fetch	2026-06-13 11:40:35 +07:00
store	feat(db): migrate from lowdb to SQLite with repos pattern	2026-05-09 17:48:20 +07:00
dashboardGuard.js	fix(auth): real client IP rate-limiting + remote default-password guard	2026-06-08 12:10:02 +07:00
proxy.js	fix: use export default in proxy.js for Next.js 16 middleware detection	2026-06-13 09:57:20 +07:00