ulivargas/classroomio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,306 Commits 1 Branch 0 Tags
cc04fba42eafb5da3df4e856ce2647263afedf5d
Commit Graph
19 Commits
Author SHA1 Message Date
Rotimi Best ea93075bd5 fix: update content security policy to allow YouTube and refine source origins 2025-12-04 00:10:15 +01:00
Rotimi Best 25d1a8d710 Security Release v0.2.6: Email Verification Bypass Vulnerabilities Fixed 
Critical security fixes addressing email verification bypass vulnerabilities:

Security Issues Fixed:
- Email verification status manipulation through client-side profile updates
- Base64 token forgery allowing arbitrary email verification
- DOM manipulation bypasses of email verification modal

Backend Security Enhancements:
- Secure verification tokens table with cryptographic token generation
- RLS policies preventing direct email verification status changes
- Server-side validation functions with expiration and ownership checks
- Database triggers blocking unauthorized verification status updates
- IP address logging and audit trails for security monitoring

Frontend Security Protections:
- Multi-layered DOM protection preventing UI manipulation bypasses
- Continuous monitoring and re-application of interaction restrictions
- CSS-based backup protection even if JavaScript is disabled
- Mutation observer to protect dynamically added elements
- Enhanced CSP configuration for Senja widget support

API Security Updates:
- Secure token-based verification replacing insecure Base64 method
- Comprehensive error handling with security-focused user messages
- Token validation with signature verification and expiration checks
- Legacy verification method blocking with security warnings
- Enhanced verification email generation with secure tokens

Files Modified:
- Database: New email_verification_tokens table and security functions
- API: Secure verification endpoints with token validation
- Frontend: DOM protection and verification modal enhancements
- CSP: Updated Content Security Policy configuration
- Blog: Security advisory for CVE-2025-65675 disclosure

This release patches critical authentication bypass vulnerabilities and
implements defense-in-depth security measures across the entire platform.

Security researchers and users should upgrade immediately.
 2025-12-03 15:33:04 +01:00
Rotimi Best 4ac242d918 fix: add PostHog domains to CSP connect-src 
- Add https://*.i.posthog.com to both enforcement and reportOnly CSP
- Resolves CSP violations blocking PostHog source maps and assets
- Fixes blocked requests to recorder.js.map and surveys.js.map

This ensures PostHog analytics work properly without CSP violations.
 2025-12-03 10:28:02 +01:00
Rotimi Best 9fe7691f8d fix: CSP configuration for API and media access 
- Add https://api.classroomio.com to connect-src for API calls
- Add https://*.r2.cloudflarestorage.com for Cloudflare R2 storage
- Add media-src directive to allow video/document loading
- Fixes CSP violations blocking video downloads and API requests

Resolves CSP errors preventing presigned URL requests and media playback.
 2025-12-03 10:10:08 +01:00
Rotimi Best 7014757ed5 fix: add PostHog and Umami analytics to CSP 
- Added https://eu-assets.i.posthog.com for PostHog scripts
- Added https://eu.i.posthog.com for PostHog API calls
- Added https://umami.hz.oncws.com for Umami analytics
- Maintains XSS protection while enabling analytics
 2025-12-03 09:44:31 +01:00
Rotimi Best 7b18c325da fix: cross site scripting with html content 2025-12-03 09:33:53 +01:00
Rotimi Best 9a7018eb34 chore: remove unused dependencies 2025-10-04 11:01:22 +01:00
Rotimi Best fd2e3f5d76 chore: clean up environment variable usage and formatting in configuration files 
- Updated docker-compose.yaml to use double quotes for version and port mappings.
- Removed DEPLOYMENT_PROVIDER from global environment variables in turbo.json and Dockerfile.
- Adjusted dashboard build command in package.json to remove DEPLOYMENT_PROVIDER.
- Cleaned up .env.example by removing the DEPLOYMENT_PROVIDER comment.
- Simplified SvelteKit adapter condition in svelte.config.js.
 2025-10-04 08:13:01 +01:00
Rotimi Best 9055c45384 chore: move IS_SELFHOSTED to public env 2025-09-07 10:24:34 +01:00
Rotimi Best f8852ad34b chore: use vercel adapter in dashboard 2025-05-03 15:26:10 +01:00
Rotimi Best 91bd9d4414 docs: self-hosting guide v1 (#481) 
* feat: selfhosting guide v1 #238

* use public env on frontend

* add docker desclaimer
 2024-09-30 01:20:19 +01:00
Rotimi Best b203188091 chore: use package.json commands to build railway 2024-09-29 05:35:05 +01:00
Rotimi Best bd76342f0e chore: add new env DEPLOYMENT_PROVIDER 2024-09-27 02:50:27 +01:00
Rotimi Best 877b514a7b chore: minimize build output 2024-09-23 01:21:05 +01:00
Rotimi Best 786308ec82 feat: deploy to cloudflare (#365) 
* chore: deploy to cf

* add wrangler.toml file

* update pnpm-lock

* set pnpm version

* use adapter auto
 2024-06-17 00:45:51 +01:00
Rotimi Best 60ea5fb00a chore: rename 'nodemailer' to 'mail' 2024-04-12 05:37:50 +01:00
Em_DevandRotimi Best 3fe15e6633 feat: remove defer (#243) 
* working on moving the email logic to the backend

* Moved nodemailer to the backend

* uninstall defer

* updated relative import path in tsconfig

* working on the zod validation

* Merge branch 'main' into send-email

* fixed the zod import issue

* fixed the zod import issue

* updated the env example files

* docs: update README.md (#249)

* fix: handle catex error

* chore: remove fly.io github action

* Update README.md

Updated the Readme to reflect changes made to the emailing flow

---------

Co-authored-by: Rotimi Best <best@classroomio.com>

* chore: wrapp up email sending

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
 2024-04-12 04:57:19 +01:00
Rotimi Best ff524fca27 feat: move all email to defer queue #185 
fix: use relative part for defer func #185

chore: move sendEmail into defer

fix: remove anon function to defer #185

feat: implement batch email sending with defer.run #185

chore: debug sendEmails #185

chore: add robots.txt

chore: use promise.all in sendEmails

chore: debug defer sendEmails #185

chore: try defer sendEmail without loop #105

chore: comment code

chore: change loop style #185

chore: use promise.all for vercel edge #185

feat: add await to sendEmailNotification #185

chore: use sendEmails #185

fix: debug sendEmails #185

fix: email not updating in LMS

fix: remove early return in sendEmails #185
 2024-03-01 14:10:40 +01:00
Rotimi Best 41e29014ef feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51) 
* Merge main into turbo-monrepo

* feat: rename apps

* feat: remove supbase videos and serve all from project

* feat: move supabase to root

* feat: update README

* docs: update link
 2023-11-25 21:56:02 +00:00