8eda67a39e
fix(docs): correct shellAfterCompleted quoting for output and exitCode
...
The after-completion example put {{ output }} and {{ exitCode }} inside
single-quoted shell arguments, so and never expanded
after substituteShellAfterCompletedEnvRefs runs.
Update the apprise sample to use printf-based quoting that allows env
substitution, document the single-quote pitfall, and extend
TestShellAfterCompletedUsesOutputEnvSafely to assert stdout is
substituted as well as injection being blocked.
2026-07-08 14:01:43 +01:00
4ef86abee7
security: GHSA-vc6p-m6vx-6cwq (HIGH) harden shellAfterCompleted execution
...
Route output and exitCode through OUTPUT/EXITCODE environment variables
instead of shell interpolation, and block shellAfterCompleted for webhook
actions.
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-08 12:29:37 +01:00
1396184777
fix(executor): always anchor custom regex patterns and harden shellAfterCompleted
...
Wrap regex: patterns in a non-capturing group before applying ^...$ so
alternation cannot bypass full-string matching. Return template parse
errors from buildShellAfterCommand, and guard nil binding/action before
building shellAfterCompleted commands.
2026-07-08 10:46:13 +01:00
0e45f3b0e3
security: GHSA-xc5w-4v5w-7x65 (HIGH) harden shell argument type safety
...
Block additional unvalidated argument types from shell actions, enforce
full-string custom regex matching, and allowlist http/https URL schemes.
Update checkbox integration test to use exec, matching the intended shell
vs exec split for choiceless checkbox arguments.
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-08 09:40:48 +01:00
42f2572616
fix(config): reject ambiguous checklist comma format and propagate encode errors
...
ParseChecklistValue now accepts JSON arrays or single bare values and rejects
legacy comma-separated input. Empty JSON segments are validated consistently,
and FormatChecklistValue returns marshal errors instead of an empty string
2026-07-07 11:57:20 +01:00
9dc51df01d
fix: harden checklist JSON wire format, entity pagination, and review findings across API and UI
2026-07-07 10:14:17 +01:00
a530dca579
refactor: collapse action justification into a string template field
...
Use a single justification string for both requirement and templating so
empty values skip prompts while templates can prefill audit reasons at start.
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-06 20:36:30 +01:00
b18518ebea
fix: add support for entities in checklists
2026-07-06 12:17:03 +01:00
e24ae6265b
feat: Checklist support ( #922 )
2026-07-06 11:01:22 +01:00
a413f9d6af
chore: fix flakey tests
2026-06-29 00:03:31 +01:00
5fca2d9482
Merge branch 'next' into feat/better-prometheus-metrics
2026-06-28 23:17:28 +01:00
57f3ef46ad
fix: several merge messes
2026-06-28 22:52:16 +01:00
42003da384
fix: rerun args
2026-06-26 23:25:24 +01:00
d1787a3823
feat: Better prometheus support
2026-06-25 23:05:47 +01:00
03d188337e
fix: Parse templates in action ( #1035 )
2026-06-20 00:26:13 +01:00
7bd6e77ae2
chore: fix race conditions and little bugs
2026-06-19 09:56:41 +01:00
633d9ecd82
feat: action group sizing
2026-06-18 23:33:27 +01:00
de63793b3a
feat: circle indicator for running actions, justification support
2026-06-17 23:29:30 +01:00
f4b3c4289a
chore: Fix many little niggly bugs, test flakes, etc
2026-06-17 22:18:26 +01:00
6aa672e6c0
feat: Logs filtering, and log queue with group concurrency
2026-06-16 14:16:43 +01:00
ebffd9f040
security: GHSA-prj9-97mp-mwh2 (HIGH) Treat all ot_ system arguments as reserved, preventing RCE
...
Ensure OliveTin-owned arguments are injected only after filtering and validate system values before command execution.
2026-05-31 22:44:40 +01:00
bc5e9fbe1e
security: GHSA-xx6g-43w2-9g6g (MODERATE) Email argument makes compliance harder, enables log injection
2026-03-10 23:27:09 +00:00
2f77000de4
security: GHSA-364q-w7vh-vhpc (HIGH) Unsafe parsing of UniqueTrackingId can be used to write files
2026-03-08 23:29:00 +00:00
5ff6b5d080
fix: Entity ordering ( #886 , #762 )
2026-03-08 22:16:24 +00:00
9080577f2b
chore: potential crash in unit tests
2026-03-05 08:10:56 +00:00
00cb5a2abf
fix: action triggers were broken #914
2026-03-04 23:12:20 +00:00
0c47564652
chore: logs are written with 0600 instead of 0644
2026-03-04 23:12:20 +00:00
4744169aa0
chore: code cleanup, remove todos, etc
2026-02-26 23:07:07 +00:00
38d6b57077
chore: codefmt
2026-02-25 23:24:02 +00:00
4bbd2eab15
security: GHSA-49gm-hh7w-wfvf
2026-02-22 10:19:08 +00:00
1248ee8765
chore: remove extranious comments
2026-02-13 23:36:16 +00:00
b777d599aa
fix: Massive cleanup of template parsing
2026-02-07 00:09:46 +00:00
54080efdf3
Fix move tpl to global ( #848 )
2026-01-26 11:33:36 +00:00
0e0bbd3fdb
fix: Nil binding on entity logs caused a NPE
2026-01-26 00:34:39 +00:00
b37f035ea6
fix: Move templating functionality to global, making it possible to replace templates across the config
2026-01-25 10:32:22 +00:00
b9f55ab508
fix: load logs on startup ( #299 )
2026-01-23 14:18:30 +00:00
e3c785319a
fix: Kill entire process group on timeout ( #605 )
2026-01-21 23:52:35 +00:00
a10088a040
chore: Fix duplicate code in executor when trying to reduce cyclo
2026-01-11 23:12:34 +00:00
b75d590343
Merge branch 'beta' into next
2026-01-11 23:09:49 +00:00
f173a0b725
chore: reduce gocyclo
2026-01-11 22:34:23 +00:00
242149f5a4
chore: reduce cyclo
2026-01-11 09:20:50 +00:00
832db4e135
chore: Log datetime parse failures from cal
2026-01-11 08:51:31 +00:00
a36e69b8f8
chore: calendar fixes
2026-01-11 01:50:27 +00:00
a4ff326625
chore: calendar logging fixes
2026-01-11 01:48:17 +00:00
84bd405ca9
chore: gocyclo fixes
2026-01-11 01:29:27 +00:00
6493f7bee7
feat: block notifications, and cleanup of action/binding IDs
2026-01-11 01:10:20 +00:00
b4157ed5ba
fix: argument validation on bindings
2025-12-25 01:16:04 +00:00
2956b9972f
chore: nil checks
2025-12-23 19:52:15 +00:00
8e2db0ad82
chore: reduce argument validation complexity
2025-12-23 16:47:59 +00:00
09e1f0f984
fix: Argument validation targets the bindings (fixes checkboxes, etc)
2025-12-23 16:42:00 +00:00
jamesread