alby-hub/api
Roland 3d22993389
fix: validate return_to redirect URLs (#2532)
return_to query parameters are now parsed and only http and https URLs
are used for redirects, both in the frontend and when the createApp API
adds the connection parameters to the URL.

The production frontend build now also includes the same
Content-Security-Policy meta tag that is served as a header in http
mode, so the policy also applies where no HTTP headers are set, e.g. in
the desktop app.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-11 14:57:51 +07:00
..
api.go fix: validate return_to redirect URLs (#2532) 2026-08-11 14:57:51 +07:00
api_test.go feat: proposal: custom node commands (#1007) 2025-01-30 18:20:17 +07:00
apps_test.go fix: validate return_to redirect URLs (#2532) 2026-08-11 14:57:51 +07:00
backup.go fix: prevent backup restore from writing outside the restore directory (#2529) 2026-08-10 23:42:45 +07:00
backup_test.go fix: prevent backup restore from writing outside the restore directory (#2529) 2026-08-10 23:42:45 +07:00
esplora.go Adding checks for ok status code in responses (#2178) 2026-03-31 23:21:26 +05:30
lsp.go chore: update to use sat/msat suffixes everywhere (#2271) 2026-05-01 15:41:56 +05:30
models.go fix: keep showing migration success page after creating migration file (#2527) 2026-08-10 15:37:26 +07:00
rebalance.go chore: bump rebalance fees to ensure payment succeeds (#2470) 2026-07-29 14:31:18 +07:00
transactions.go feat: filter transactions (#2464) 2026-08-07 10:52:14 +07:00
transactions_test.go feat: filter transactions (#2464) 2026-08-07 10:52:14 +07:00