ulivargas/classroomio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,715 Commits 1 Branch 0 Tags
656fa4fa7e583701ac2b7dc510612c51cd105253
Commit Graph
62 Commits
Author SHA1 Message Date
Rotimi Best b31ccf3037 feat: lint codebase and run precommit hook 2025-12-25 09:01:51 +00:00
Rotimi Best 25d1a8d710 Security Release v0.2.6: Email Verification Bypass Vulnerabilities Fixed 
Critical security fixes addressing email verification bypass vulnerabilities:

Security Issues Fixed:
- Email verification status manipulation through client-side profile updates
- Base64 token forgery allowing arbitrary email verification
- DOM manipulation bypasses of email verification modal

Backend Security Enhancements:
- Secure verification tokens table with cryptographic token generation
- RLS policies preventing direct email verification status changes
- Server-side validation functions with expiration and ownership checks
- Database triggers blocking unauthorized verification status updates
- IP address logging and audit trails for security monitoring

Frontend Security Protections:
- Multi-layered DOM protection preventing UI manipulation bypasses
- Continuous monitoring and re-application of interaction restrictions
- CSS-based backup protection even if JavaScript is disabled
- Mutation observer to protect dynamically added elements
- Enhanced CSP configuration for Senja widget support

API Security Updates:
- Secure token-based verification replacing insecure Base64 method
- Comprehensive error handling with security-focused user messages
- Token validation with signature verification and expiration checks
- Legacy verification method blocking with security warnings
- Enhanced verification email generation with secure tokens

Files Modified:
- Database: New email_verification_tokens table and security functions
- API: Secure verification endpoints with token validation
- Frontend: DOM protection and verification modal enhancements
- CSP: Updated Content Security Policy configuration
- Blog: Security advisory for CVE-2025-65675 disclosure

This release patches critical authentication bypass vulnerabilities and
implements defense-in-depth security measures across the entire platform.

Security researchers and users should upgrade immediately.
 2025-12-03 15:33:04 +01:00
Rotimi Best fb2ea885e1 chore: update translation 2025-12-03 10:59:08 +01:00
Nwosu Emmanuel 8efffcb7f6 feat: clone course (#582) 
* feat: clone course work

* feat: clone and delete a course

* feat: clone and delete a course

* feat: clean up

* feat: attending to reviews

* feat: attended to revies
 2025-10-29 09:57:29 +01:00
Adeyemi Adetunji f8271d850f fix: dashboard i18n build/console warnings (#587) 
* fix: build warnings

* feat: remove other instances of invalid_type_error and the unused translation key
 2025-10-29 09:34:30 +01:00
Adeyemi Adetunji b9b19d8a2e feat: add search and replace to tinymce editor (#585) 2025-10-28 11:59:21 +01:00
Nwosu Emmanuel 6cae0f1506 fix: pushed fix for landing page (#579) 2025-10-13 14:39:57 +01:00
Nwosu EmmanuelandRotimi Best 27ee51155e feat: add custom navigation link to org landing page (#569) 
* feat: custom navbar UI complete

* chore: added translations

* fear: attending to reviews

* add orgname to org landing page

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
 2025-10-09 01:13:06 +01:00
Rotimi Best 6d68351a46 feat: end to end api type safety with redis rate limiting (#573) 
* feat: support hono rpc

* add wrangler file

* update name of wrangler file

* add wrangler as a dependency

* add compatibility_flags

* trigger ci

* core: add health check to docker file

* expose port 80

* update custom healthcheck

* feat: implement openapi

* install dependencies in root

* debug yml

* update yml

* update port

* update dockerfile with envs

* completely move away from apiClient

* rename backend to api

* refactor: update server descriptions and comment out local spec saving

* update lock file

* use api.classroomio.com

* add support for redis

* fix: add missing line break in WelcomeModal.svelte

* refactor: remove wrangler configuration and update Vite config for API integration
 2025-09-21 19:35:41 +01:00
Nwosu EmmanuelandRotimi Best ec3875bac2 feat: course analytics (#574) 
* feat: added anaytics for the course page

* feat: Added pagination

* feat: cleanup

* feat: added translations

* feat: added fixes

* my improvements

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
 2025-09-18 01:00:49 +01:00
Nwosu EmmanuelandRotimi Best 937f1d8155 feat: add documents to Lesson materials (#572) 
* feat: Initial logic for the pdf upload

* feat: uploa logic, translations and ui flow complete

* chore:console log cleanup

* feat: fixed upload issue and added cancel upload button

* feat: fixing the download document ish

* feat: All done and ready for use

* feat: updated the document viewing logic

* feat: some minor refactor

* feat: added migration file

* fix: dark mode, translations, restyling,

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
 2025-09-10 11:39:06 +01:00
Rotimi Best 279d10a914 feat: add Polish language support 2025-08-08 04:53:38 +01:00