3 Commits

Author	SHA1	Message	Date
Darko Gjorgjijoski	99ea898e88	fix(security): block SSRF via the Gotenberg host setting (GHSA-mfxg) (#671) ... v3 port. The Gotenberg PDF driver was missed when the SSRF guards were added to the AI, exchange-rate and file-disk drivers: gotenberg_host was validated only with 'url', and the driver POSTs the rendered HTML to it. Reuses the existing infrastructure (consistency with the other drivers): - Wires App\Rules\PublicHttpUrl into the gotenberg_host validation rule. - Adds PrivateNetworkGuard::assertAllowed() in GotenbergPdfDriver before the outbound call (covers env/seed/stale config + DNS rebinding). Adds a unit test asserting the gotenberg_host rule rejects private/loopback/ link-local addresses and allows a public one.	2026-06-12 11:02:19 +02:00
Darko Gjorgjijoski	18d63a3375	Configurations cleanup & database configurations for mail and pdfs (#479) ... * Move Mail, PDF configuration to Database, standardize configurations * Set default currency to USD on install * Pint code	2025-09-19 15:42:53 +02:00
Tim van Osch	bf40f792c2	Feat(Gotenberg): Opt-in alternative pdf generation for modern CSS (#184) ... * WIP(gotenberg): add pdf generation abstraction and UI * feat(pdf): settings validate(clien+server) & save * fix(gotenberg): Use correct default papersize chore(gotengberg): Remove unused GOTENBERG_MARGINS env from .env * style(gotenberg): fix linter/styling issues * fix(pdf): use pdf config policy * fix: revert accidental capitalization in mail config vue * Update composer, remove whitespace typo * Fix small typos * fix cookie/env issue * Add gotenberg to .dev, move admin menu item up	2025-05-04 02:10:15 +02:00