fix: enable CSRF protection globally with @csrf on all Blade forms (CWE-352)#3670

Open

javokhir-sec wants to merge 21 commits into

Leantime:masterfrom

javokhir-sec:fix/csrf-global-enable

Commits on Jul 21, 2026

fix: validate file path in Blueprints::import() to prevent SSRF/LFI

javokhir-sec
and
claude
committed
fix(blueprints): harden import() path validation against SSRF/LFI

javokhir-sec
and
claude
committed
fix(blueprints): address Copilot review — TOCTOU, log level, test assertions

javokhir-sec
and
claude
committed
fix(test): correct XML canvas key to match getDatabaseType()

javokhir-sec
and
claude
committed
fix(test): use correct box name 'problem' from lean canvas template

javokhir-sec
and
claude
committed
style: fix pint formatting
javokhir-sec
committed
style: fix pint formatting
javokhir-sec
committed
fix(test): apply Copilot review — portability, unique names, cleanup
javokhir-sec
committed
Merge branch 'fix/ssrf-lfi-final' into fix/pint-csrf-final
javokhir-sec
committed
chore: remove accidentally added files
javokhir-sec
committed
fix: use base_path() for userfiles + fix tempnam orphan file
javokhir-sec
committed
fix(test): replace tempnam with rename to avoid orphaned temp files
javokhir-sec
committed
Merge branch 'fix/ssrf-lfi-final' into fix/pint-csrf-final
javokhir-sec
committed
fix(test): proper LFI test using .xml outside allowed dirs
javokhir-sec
committed
Merge branch 'fix/ssrf-lfi-final' into fix/pint-csrf-final
javokhir-sec
committed

Commits on Jul 23, 2026