petrbalvin 1ca0212197 security: add slug validation, username validation, and template escaping ...

- Enforce SLUG_REGEX (alphanumeric + dot/dash/underscore only) in creation_error
  to prevent path traversal (C-1) and stored XSS (C-3).
- Add File.expand_path containment check in default_path_for as defense-in-depth.
- Escape slug in form action attributes (list, form views).
- Validate username in change_username using the same regex as create_user (C-4).
- Escape username in settings form action attributes.
- Treat submitting the current username as a no-op success instead of 'taken'.

2026-06-25 22:06:49 +02:00

..

volumen

security: add slug validation, username validation, and template escaping

2026-06-25 22:06:49 +02:00

volumen.rb

fix: add periodic cleanup of login_attempts hash

2026-06-25 21:40:37 +02:00