mirror of https://github.com/docusealco/docuseal
Sweep of stale upstream cruft and missing release-process plumbing: - SECURITY.md routes vuln reports to wabosign@wabo.cc - package.json renamed wabosign + license/repository fields - Drop the docuseal.com fallback href in signature_step.vue - Delete docs/api/ (10 upstream language stubs) and rewrite stale docuseal.com URLs in docs/openapi.json + docs/embedding/* + docs/webhooks/* to sign.wabo.cc - Remove console_redirect + enquiries controllers and routes (/upgrade, /manage, /console_redirect were DocuSeal-SaaS-only). Strip the navbar Console icon, the embed_scripts upgrade-to-Pro fallback, the sessions_controller CONSOLE_URL redirect, and the CONSOLE_URL/CDN_URL/CLOUD_URL/ENQUIRIES_URL constants. The four "Learn more" links in templates/_embedding.html.erb now point at sign.wabo.cc/docs/embedding; the two CDN script-src refs use the local embed_script_url helper. - Dockerfile gains OCI image labels via ARG VERSION/REVISION - docker.yml passes labels + build-args from metadata-action@v5 so the published image has the right manifest-level metadata - Add CHANGELOG.md (Keep-a-Changelog) and a Releases section in README Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>pull/687/head
Wabo
1 month ago
parent
27af280dee
commit
a1ca9c5791
@ -0,0 +1,34 @@
|
||||
# Changelog
|
||||
|
||||
All notable changes to WaboSign are documented here. The format is based on
|
||||
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project
|
||||
adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
||||
|
||||
## [1.0.0] — 2026-05-17
|
||||
|
||||
First WaboSign release. Forked from [DocuSeal](https://github.com/docusealco/docuseal) 2.5.3.
|
||||
|
||||
### Added
|
||||
- Google Workspace SSO via `omniauth-google-oauth2`, configurable from `/settings/sso` with ENV + DB fallback. See [GOOGLE_SSO.md](GOOGLE_SSO.md).
|
||||
- SMS invitations via BulkVS, configurable from `/settings/sms`. See [SMS.md](SMS.md).
|
||||
- Custom account logo upload with server-side SVG sanitization. The logo renders on the sign-in page, signing flow, dashboard navbar, share-link QR page, and audit-trail PDFs.
|
||||
- Editor and Viewer user roles alongside Admin. Editors get CRUD on templates and submissions; Viewers get read-only access. Self-service profile management is preserved for every role.
|
||||
- OCI image labels (`org.opencontainers.image.*`) and multi-arch (linux/amd64 + linux/arm64) Docker builds wired via `.github/workflows/docker.yml`.
|
||||
- [CHANGELOG.md](CHANGELOG.md) and a Releases section in [README.md](README.md).
|
||||
|
||||
### Changed
|
||||
- Removed the upstream "Pro" feature paywall — multi-account, SSO, SMS, audit trail, and timestamping all work out of the box on a self-hosted deployment.
|
||||
- Rebranded all UI surfaces, emails, and asset paths from DocuSeal to WaboSign while preserving AGPL §7(b) upstream attribution in [NOTICE](NOTICE), [REBRANDING.md](REBRANDING.md), [LICENSE_ADDITIONAL_TERMS](LICENSE_ADDITIONAL_TERMS), and the in-app "Powered by" footer.
|
||||
- Default container image is now `ghcr.io/wabolabs/wabosign` (public).
|
||||
- Security contact in [SECURITY.md](SECURITY.md) now routes to `wabosign@wabo.cc`.
|
||||
|
||||
### Removed
|
||||
- Developer Newsletter step from the initial-setup flow (was a DocuSeal mailing-list signup).
|
||||
- Console-redirect endpoints (`/upgrade`, `/manage`, `/console_redirect`) and the enquiries form — only made sense for DocuSeal's hosted multitenant SaaS.
|
||||
- Upstream API-docs language stubs at `docs/api/` (10 files referencing `api.docuseal.com`). The OpenAPI spec at `docs/openapi.json` and the embedding/webhook guides remain (URLs rewritten to `sign.wabo.cc`).
|
||||
- The "Upgrade to Pro" fallback markup served by the embed-script controller — replaced with a neutral "embed assets not loaded" message.
|
||||
|
||||
### Security
|
||||
- Account-logo SVG uploads are sanitized via Nokogiri before storage (strips `<script>`, `<foreignObject>`, `on*` attributes, and external `href` / `xlink:href` values).
|
||||
|
||||
[1.0.0]: https://github.com/wabolabs/wabosign/releases/tag/1.0.0
|
||||
@ -1,14 +1,12 @@
|
||||
# Reporting a Vulnerability
|
||||
|
||||
If you come across any security concern or vulnarability, please report the information via email to security@docuseal.com instead of opening a GitHub issue. We will promptly respond and will collaborate with you to validate the issue, and resolve it ASAP.
|
||||
If you discover a security concern or vulnerability in WaboSign, please report it privately by email to **wabosign@wabo.cc** rather than opening a public GitHub issue. We will acknowledge receipt, work with you to validate the report, and ship a fix.
|
||||
|
||||
**We have a bug bounty program to reward security researchers.**
|
||||
|
||||
Out of scope vulnerabilities:
|
||||
## Out of scope
|
||||
|
||||
- CSRF
|
||||
- DNSSEC, CAA, CSP headers
|
||||
- DNS or email security related
|
||||
- Rate Limiting
|
||||
- Rate limiting
|
||||
|
||||
Note: We reserve the right to classify any reported vulnerability as out of scope for the bug bounty program.
|
||||
We reserve the right to classify any reported issue as out of scope.
|
||||
|
||||
@ -1,26 +0,0 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
class ConsoleRedirectController < ApplicationController
|
||||
skip_before_action :authenticate_user!
|
||||
skip_authorization_check
|
||||
|
||||
def index
|
||||
if request.path == '/upgrade'
|
||||
params[:redir] = Wabosign.multitenant? ? "#{Wabosign::CONSOLE_URL}/plans" : "#{Wabosign::CONSOLE_URL}/on_premises"
|
||||
end
|
||||
|
||||
params[:redir] = "#{Wabosign::CONSOLE_URL}/manage" if request.path == '/manage'
|
||||
|
||||
return redirect_to(new_user_session_path({ redir: params[:redir] }.compact)) if true_user.blank?
|
||||
|
||||
auth = JsonWebToken.encode(uuid: true_user.uuid,
|
||||
scope: :console,
|
||||
exp: 1.minute.from_now.to_i)
|
||||
|
||||
redir_uri = Addressable::URI.parse(params[:redir])
|
||||
path = redir_uri.path if params[:redir].to_s.starts_with?(Wabosign::CONSOLE_URL)
|
||||
|
||||
redirect_to "#{Wabosign::CONSOLE_URL}#{path}?#{{ **redir_uri&.query_values, 'auth' => auth }.to_query}",
|
||||
allow_other_host: true
|
||||
end
|
||||
end
|
||||
@ -1,22 +0,0 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
class EnquiriesController < ApplicationController
|
||||
skip_before_action :authenticate_user!
|
||||
skip_authorization_check
|
||||
|
||||
def create
|
||||
if params[:talk_to_sales] == 'on'
|
||||
Faraday.post(Wabosign::ENQUIRIES_URL,
|
||||
enquiry_params.merge(type: :talk_to_sales).to_json,
|
||||
'Content-Type' => 'application/json')
|
||||
end
|
||||
|
||||
head :ok
|
||||
end
|
||||
|
||||
private
|
||||
|
||||
def enquiry_params
|
||||
params.require(:user).permit(:email)
|
||||
end
|
||||
end
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
Loading…
Reference in new issue