Darko Gjorgjijoski 99ea898e88 fix(security): block SSRF via the Gotenberg host setting (GHSA-mfxg) (#671) ...

v3 port. The Gotenberg PDF driver was missed when the SSRF guards were added
to the AI, exchange-rate and file-disk drivers: gotenberg_host was validated
only with 'url', and the driver POSTs the rendered HTML to it.

Reuses the existing infrastructure (consistency with the other drivers):
- Wires App\Rules\PublicHttpUrl into the gotenberg_host validation rule.
- Adds PrivateNetworkGuard::assertAllowed() in GotenbergPdfDriver before the
  outbound call (covers env/seed/stale config + DNS rebinding).

Adds a unit test asserting the gotenberg_host rule rejects private/loopback/
link-local addresses and allows a public one.

2026-06-12 11:02:19 +02:00

..

Controllers

fix(security): harden public EmailLog token endpoints (GHSA-73q7) (#669)

2026-06-12 11:02:11 +02:00

Middleware

refactor(support): group Bouncer, Media, Setup files into subdirs

2026-04-11 15:00:00 +02:00

Requests

fix(security): block SSRF via the Gotenberg host setting (GHSA-mfxg) (#671)

2026-06-12 11:02:19 +02:00

Resources

refactor(modules): marketplace install flow with checksum validation

2026-04-10 17:30:00 +02:00