ulivargas/classroomio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,297 Commits 1 Branch 0 Tags
25d1a8d710fed1a4de98f02f1bcfdf215c149be5
Commit Graph
1297 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Rotimi Best 25d1a8d710 Security Release v0.2.6: Email Verification Bypass Vulnerabilities Fixed 
Critical security fixes addressing email verification bypass vulnerabilities:

Security Issues Fixed:
- Email verification status manipulation through client-side profile updates
- Base64 token forgery allowing arbitrary email verification
- DOM manipulation bypasses of email verification modal

Backend Security Enhancements:
- Secure verification tokens table with cryptographic token generation
- RLS policies preventing direct email verification status changes
- Server-side validation functions with expiration and ownership checks
- Database triggers blocking unauthorized verification status updates
- IP address logging and audit trails for security monitoring

Frontend Security Protections:
- Multi-layered DOM protection preventing UI manipulation bypasses
- Continuous monitoring and re-application of interaction restrictions
- CSS-based backup protection even if JavaScript is disabled
- Mutation observer to protect dynamically added elements
- Enhanced CSP configuration for Senja widget support

API Security Updates:
- Secure token-based verification replacing insecure Base64 method
- Comprehensive error handling with security-focused user messages
- Token validation with signature verification and expiration checks
- Legacy verification method blocking with security warnings
- Enhanced verification email generation with secure tokens

Files Modified:
- Database: New email_verification_tokens table and security functions
- API: Secure verification endpoints with token validation
- Frontend: DOM protection and verification modal enhancements
- CSP: Updated Content Security Policy configuration
- Blog: Security advisory for CVE-2025-65675 disclosure

This release patches critical authentication bypass vulnerabilities and
implements defense-in-depth security measures across the entire platform.

Security researchers and users should upgrade immediately.
 2025-12-03 15:33:04 +01:00
Rotimi Best 43e6cd611d chore: auto logout test emails. 2025-12-03 13:48:25 +01:00
Rotimi Best 900f5ec129 fix: critical SVG XSS vulnerability in file uploads 
- Add comprehensive file type validation to prevent SVG uploads
- Update upload widgets to restrict file types at input level
- Enhanced HTML sanitization to block SVG tags and data URLs
- Create centralized file validation utilities with shared constants
- Add client-side and server-side protection against malicious uploads

Security Impact:
- Prevents stored XSS attacks through malicious SVG profile uploads
- Blocks execution of JavaScript embedded in SVG files
- Enforces whitelist of safe image formats (JPEG, PNG, GIF, WebP)
- Provides defense-in-depth protection across all upload components

Fixes reported vulnerability in profile image upload functionality.
 2025-12-03 11:25:00 +01:00
Rotimi Best fb2ea885e1 chore: update translation 2025-12-03 10:59:08 +01:00
Rotimi Best 4ac242d918 fix: add PostHog domains to CSP connect-src 
- Add https://*.i.posthog.com to both enforcement and reportOnly CSP
- Resolves CSP violations blocking PostHog source maps and assets
- Fixes blocked requests to recorder.js.map and surveys.js.map

This ensures PostHog analytics work properly without CSP violations.
 2025-12-03 10:28:02 +01:00
Rotimi Best 9fe7691f8d fix: CSP configuration for API and media access 
- Add https://api.classroomio.com to connect-src for API calls
- Add https://*.r2.cloudflarestorage.com for Cloudflare R2 storage
- Add media-src directive to allow video/document loading
- Fixes CSP violations blocking video downloads and API requests

Resolves CSP errors preventing presigned URL requests and media playback.
 2025-12-03 10:10:08 +01:00
Rotimi Best 07ecfcf967 fix: authorization bypass vulnerabilities in plan-restricted features 
- Add plan validation to custom domain saving (Domains.svelte)
- Add plan validation to certificate customization (Design.svelte)
- Add plan validation to document upload (AddDocumentToLesson.svelte)
- Add plan validation to video upload (UploadVideo.svelte)
- Enhance team member function validation (TeamMembers.svelte)

Prevents free users from bypassing UI restrictions via DOM manipulation.
All restricted functions now enforce server-side plan validation.
 2025-12-03 10:01:50 +01:00
Rotimi Best 7014757ed5 fix: add PostHog and Umami analytics to CSP 
- Added https://eu-assets.i.posthog.com for PostHog scripts
- Added https://eu.i.posthog.com for PostHog API calls
- Added https://umami.hz.oncws.com for Umami analytics
- Maintains XSS protection while enabling analytics
 2025-12-03 09:44:31 +01:00
Rotimi Best 7b18c325da fix: cross site scripting with html content 2025-12-03 09:33:53 +01:00
Rotimi Best f2b719cd1b chore: more email validation 2025-12-03 07:31:35 +01:00
Rotimi Best 1e966aaf0f fix: redirect to 404 page after user closes welcome modal. 
This is because when you close the modal we redirect you to /org/siteName/courses but if you click close before we get your organization siteName the route is just /courses which redirects to a 404.
 2025-11-18 19:16:51 +01:00
Rotimi Best cc7868276a fix: use prebuilt carbon all.css without border 2025-11-18 14:40:10 +01:00
Tanushree Ahir f7006aecdb fix: footer navigation overflows on small screens (#599) 2025-11-18 07:03:11 +01:00
Rotimi Best b8c15eabe3 chore: remove debug console log from app.svelte 
Removed console log for global store in app.svelte.
 2025-11-08 20:20:38 +01:00
Rotimi Best 34e5cab733 chore: [FIXED] clean up console logs in layout and pricing components, add context prompt for ClassroomIO 
This point I have fixed 2 major issues
1. After signing in with Google auth, join a course and going to the course, when you click the back button in the page nav, it takes you to admin instead of lms

2. When you open a course landing page, click enroll, it redirects to 404 instead of the invite page.
 2025-11-08 18:47:53 +01:00
Rotimi Best b3d5f291f0 chore: fix issue of isOrgSite being false after google auth 2025-11-08 18:27:00 +01:00
Rotimi Best aa42eb9c1f chore: reorder layout setup and debug org set after login 2025-11-08 18:22:41 +01:00
Rotimi Best b783940cee fix: keep org store after logout 
This fix tackled a bug where if I logged out, go to org landing page, open a course and enrol then it gets redirected to a 404 page because `$currentOrg.siteName` is undefined.
 2025-11-08 17:58:03 +01:00
Rotimi Best 93db0c97e8 chore: use hasSession to check if auth token exists 2025-11-08 17:30:22 +01:00
Rotimi Best 0f433cfa93 chore: debug enrollment on lms 2025-11-08 06:11:44 +01:00
Rotimi Best 9e4609dc7f fix: redirect to login if no session on invite page 2025-11-08 05:51:09 +01:00
Rotimi Best 3d64e25b89 chore: debug lms detection on client side 2025-11-08 05:34:17 +01:00
Rotimi Best 7715834566 chore: debug getSubdomain 2025-11-08 05:22:38 +01:00
Rotimi Best 291e233700 chore: enable auto redirect on layout mount 
The use case for this is that if a person went from course page to invite page, and isn't authenticated then the user should be redirected to login page with a redirect query param
 2025-11-08 05:02:17 +01:00
Rotimi Best 570b809111 chore: debug join course 2025-11-08 04:52:42 +01:00
Rotimi Best 2d7de6609c chore: split clean command into 2 (node_modules and pnpm) 2025-11-01 15:57:10 +01:00
Rotimi Best eb40b6dab6 fix: remove message from email verification response 2025-11-01 11:53:27 +01:00
Rotimi Best ba0fc32a87 chore: add a clean command 2025-11-01 11:25:32 +01:00
Rotimi Best 86adad9358 fix: onboarding validation error showing translation key #586 (#593) 
* fix: onboarding validation error showing translation key #586

* fix: remove debug log for profile update errors
 2025-11-01 09:54:19 +01:00
Adeyemi Adetunji 97fb446df5 fix: snackbar for profile component (#588) 2025-10-31 18:28:52 +01:00
Nwosu Emmanuel 8efffcb7f6 feat: clone course (#582) 
* feat: clone course work

* feat: clone and delete a course

* feat: clone and delete a course

* feat: clean up

* feat: attending to reviews

* feat: attended to revies
 2025-10-29 09:57:29 +01:00
Adeyemi Adetunji f8271d850f fix: dashboard i18n build/console warnings (#587) 
* fix: build warnings

* feat: remove other instances of invalid_type_error and the unused translation key
 2025-10-29 09:34:30 +01:00
Adeyemi Adetunji b9b19d8a2e feat: add search and replace to tinymce editor (#585) 2025-10-28 11:59:21 +01:00
Adeyemi AdetunjiandRotimi Best 3692046077 feat: add danish support to dashboard (#580) 
* feat: Add Danish Support

* feat: add migration file

* chore: update migrations

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
 2025-10-13 18:07:46 +01:00
Rotimi Best c31e5e131f chore: update org mock data 2025-10-13 15:49:50 +01:00
Rotimi Best 23ef0661eb fix: add address translation to en.json 2025-10-13 15:46:28 +01:00
Rotimi Best c34379f6a2 chore: set default of customLinks 2025-10-13 15:35:02 +01:00
Nwosu Emmanuel 6cae0f1506 fix: pushed fix for landing page (#579) 2025-10-13 14:39:57 +01:00
Rotimi Best ab89837e29 chore: align logo on org landing page 2025-10-12 17:43:43 +01:00
Rotimi Best 92cc922a40 chore: reorder org import 2025-10-12 17:30:39 +01:00
Rotimi Best 41de98083f fix: show navigation if slugname include routes to hide nav 2025-10-12 14:02:47 +01:00
Rotimi Best 9c9f049917 chore: clean up docker-publish.yml by removing unused tag types 2025-10-11 14:41:47 +01:00
Rotimi Best 775e616d26 chore: update compose to use latest image 2025-10-11 14:33:26 +01:00
Rotimi Best 876a785b3c chore: pass port to cio-api 2025-10-11 14:26:14 +01:00
Rotimi Best f629aea625 chore: v0.1.12 add port to env for dashboard 2025-10-11 14:21:41 +01:00
Rotimi Best d6da36bec5 chore: update docker-compose to use version 0.1.11 for API and dashboard images 2025-10-11 14:08:57 +01:00
Rotimi Best 2a1db30916 chore: add port to start command in dashboard 2025-10-11 14:08:20 +01:00
Rotimi Best fcebabf1f0 chore: use v0.1.10 in compose 2025-10-11 14:04:40 +01:00
Rotimi Best 6a459b48f4 chore: use docker file for api 2025-10-11 13:51:14 +01:00
Rotimi Best 1275f4b7a5 chore: install pnpm global in railway config 2025-10-11 13:48:59 +01:00