3 Commits

Author	SHA1	Message	Date
Darko Gjorgjijoski	d615cfb4ff	fix(security): block SSRF via the Gotenberg host setting (GHSA-mfxg) (#664) ... gotenberg_host was validated only with Laravel's 'url' rule, which permits loopback/private/link-local hosts (e.g. http://127.0.0.1, http://10.0.0.1, the cloud metadata endpoint http://169.254.169.254). When a PDF renders, the server POSTs the document HTML to that host — an SSRF primitive. - Adds App\Rules\SafeRemoteUrl: requires http(s) and rejects any host that resolves to a loopback/private/link-local/CGNAT/reserved address (IPv4 and IPv6), including literal-IP hosts. - Wires it into PDFConfigurationRequest for gotenberg_host. - Adds a defensive re-check in GotenbergPDFDriver before the outbound call to cover hosts set via env/seed/stale config or DNS rebinding (TOCTOU). Adds unit tests for the rule + validator integration.	2026-06-12 09:18:57 +02:00
Darko Gjorgjijoski	18d63a3375	Configurations cleanup & database configurations for mail and pdfs (#479) ... * Move Mail, PDF configuration to Database, standardize configurations * Set default currency to USD on install * Pint code	2025-09-19 15:42:53 +02:00
Tim van Osch	bf40f792c2	Feat(Gotenberg): Opt-in alternative pdf generation for modern CSS (#184) ... * WIP(gotenberg): add pdf generation abstraction and UI * feat(pdf): settings validate(clien+server) & save * fix(gotenberg): Use correct default papersize chore(gotengberg): Remove unused GOTENBERG_MARGINS env from .env * style(gotenberg): fix linter/styling issues * fix(pdf): use pdf config policy * fix: revert accidental capitalization in mail config vue * Update composer, remove whitespace typo * Fix small typos * fix cookie/env issue * Add gotenberg to .dev, move admin menu item up	2025-05-04 02:10:15 +02:00