2 Commits

Include renames

Author	SHA1	Message	Date
decoluaandCursor	8ac631d615	fix(ssrf): block IPv6-mapped IPv4 addresses (GHSA-hj98-rc6w-m8cw) ... isBlockedIpv6() did not normalize ::ffff:<ipv4>, allowing the SSRF filter to be bypassed. Extract and validate via isBlockedIpv4(). Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-26 12:14:30 +07:00
decoluaandCursor	0c7c9de00a	fix(security): re-auth on DB export/import + SSRF guard on web fetch ... - /api/settings/database now requires current password (header for GET, body for POST) in addition to session; CLI-token requests exempt - add verifyDashboardPassword helper reusing login bcrypt check - profile UI prompts password via modal before export/import - /v1/web/fetch rejects internal/private/metadata targets via assertPublicUrl Refs GHSA-qvfm-67h2-2qfx, GHSA-qj3v-64wj-q825 Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-13 11:40:35 +07:00