Merge security fixes from main into develop - #1312
Merged
Merged
Conversation
…) (#1176) Co-authored-by: Manas Kumar <141910018+manaskumar3003@users.noreply.github.com>
v1.10.0-beta
main <- develop
v1.11.0-beta
Update contact message
Update email subject
Closes SSRF in the webhook system (dispatch-time revalidation, DNS pinning, per-hop redirect checks, IPv6 transition decoding), spreadsheet formula injection in exports, product ownership validation on questions, capacity assignments and check-in lists, the order completion race, sale window and max_per_order enforcement at checkout, and adds a throttle to the public promo code lookup. Also queues the order, attendee, product and check-in webhook dispatch jobs, which were running inline despite the listener setting a queue.
Fix reported security advisories
…develop # Conflicts: # backend/app/Http/Actions/Reports/ExportOrganizerReportAction.php # backend/app/Services/Domain/CapacityAssignment/UpdateCapacityAssignmentService.php # backend/app/Services/Domain/Order/OrderCreateRequestValidationService.php # backend/app/Services/Domain/Question/CreateQuestionService.php # backend/app/Services/Domain/Question/EditQuestionService.php # backend/app/Validators/Rules/NoInternalUrlRule.php # backend/config/excel.php # backend/config/webhook-server.php # backend/tests/Unit/Services/Application/Handlers/Order/CompleteOrderHandlerTest.php # backend/tests/Unit/Services/Domain/Order/OrderCreateRequestValidationServiceTest.php
|
🚅 Deployed to the Hi.Events-pr-1312 environment in Hi.Events
1 service not affected by this PR
|
railway-app
Bot
temporarily deployed
to
Hi.Events / Hi.Events-pr-1312
August 11, 2026 20:39
Destroyed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings the security fixes from #1311 into develop. This is a merge rather than a cherry-pick so git records the ancestry — #1259 and #1260 were cherry-picked onto main previously and showed as absent from develop, which meant verifying them by hand rather than by SHA. Merging avoids repeating that at the v2 release.
Ten of the twenty-nine files conflicted. How each was resolved:
OrderCreateRequestValidationService— develop'ssumRequestedQuantitiesalready aggregates per product and price across order lines, so it had independently fixed themax_per_orderbypass. Develop's plumbing is kept and the aggregation half of the main-side change is dropped. The sale window checks are re-applied on top, at both product and price-tier level, since develop had neither.NoInternalUrlRule— taken wholesale from main; the rule body is now delegation toWebhookUrlValidator.CreateQuestionService,EditQuestionService,UpdateCapacityAssignmentService,ExportOrganizerReportAction— ownership checks and the formula escaper taken from main, reformatted to develop's Pint style.config/excel.php,config/webhook-server.php— one-line binder and job swaps, using develop's imported-class style.CompleteOrderHandlerTest,OrderCreateRequestValidationServiceTest— see below.Test changes needed for develop:
@dataProviderannotation to the#[DataProvider]attribute, since develop is on PHPUnit 12 where the annotation no longer binds arguments.isBeforeSaleStartDateandisAfterSaleEndDate. Without this the strict Mockery mocks throwBadMethodCallExceptionon every existing test in the file.test_rejects_duplicate_lines_exceeding_max_per_orderexpectedTest Products. Develop's message passes aproductkey into a:productsplaceholder, so the title never substitutes and the trailingsleaks into the output. Main has the correctproductskey, which the merge keeps, so the assertion is updated to the string users actually see.1019 unit tests pass. The sale window fix was checked by removing it and confirming all five new tests fail, then restoring it.