docuseal

Commit Graph

Author	SHA1	Message	Date
Wabo	5433aa4dc3	1.3.1 — address CodeQL alerts from initial scan Patch release covering the security findings from the repo's first CodeQL scan against 1.3.0: - Sanitise params[:path] before it flows into form action / link href in submissions_filters/_filter_modal (reflected XSS). - Slice required_params to email/phone before passing to find_by! / find_or_initialize_by in start_form_controller (column-name injection via template-owner-controlled link_form_fields preference). - Rewrite FULL_EMAIL_REGEXP local-part to remove the nested quantifier (ReDoS). - Replace the Bearer-token regex in mcp_controller with a string prefix check (polynomial ReDoS). - Swap Math.random()-based attachment UUIDs for crypto.randomUUID() in the submission-form Vue dropzone / signature / initials steps. - Add a workflow-level permissions: read-all block to ci.yml. See CHANGELOG.md [1.3.1] for the full per-alert breakdown and the list of CodeQL findings that are false positives in context. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	1 month ago
Wabo	6b652f8aa5	Add rebrand-sync/-check tooling for upstream merges Adds a deterministic rebrand sweep so each upstream sync is a scripted transformation rather than a manual sweep: - bin/rebrand-sync — idempotent Ruby script that rewrites DocuSeal → WaboSign tokens across the tree (Ruby module, AATL cert name, DB names, Docker user, registry/repo URLs, DOM-ID/localStorage prefix, daisyUI theme name, hardcoded UI strings). Sentinel-protects AGPL §7(b) attribution phrases, SDK custom-element identifiers, the @docuseal/* npm packages, and the docusealco/{fields-detection, pdfium-binaries,turbo} binary URLs. Deny-lists NOTICE, LICENSE_*, README, the AGPL attribution partials, calculator.js's DocuSeal LLC copyright, lib/wabosign.rb's UPSTREAM constants, and the docuseal_aatl migration that searches by the legacy name. - bin/rebrand-check — fails CI when an unintended DocuSeal reference survives in the tree. Wired in as the new `Rebrand check` job in .github/workflows/ci.yml. - REBRANDING.md gains a "Sync workflow" section documenting the per-sync steps, rerere setup, and how to keep the two scripts' allow/preserve lists in sync. - .gitattributes marks Gemfile.lock and yarn.lock as -merge — they get regenerated post-merge rather than diffed. - Latent rebrand leftovers fixed: public/service-worker.js no longer logs "DocuSeal App installed/activated"; .dockerignore and .gitignore now ignore /wabosign (the actual runtime data dir mount) rather than the stale /docuseal path. Strategy detail lives at .claude/plans/come-up-with-a-foamy-flask.md. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	1 month ago
Wabo	6033295426	Bump deprecated GitHub Actions versions - actions/checkout@v3 -> @v4 in docker.yml - actions/setup-node@v1 -> @v4 in ci.yml (both jobs that use it) - Replace deprecated `::set-output` with $GITHUB_OUTPUT in the ESLint yarn-cache-dir step The remaining Node 20 deprecation warnings on actions/cache@v4, actions/checkout@v4, and the docker/* actions will resolve once upstream ships Node 24 builds; not blocking, the runtime won't flip until 2026-06. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	1 month ago
Wabo	2796ddf424	Rebrand DocuSeal to WaboSign and unlock Pro features Renames the product to WaboSign across UI, mailers, locales, assets, and internal Ruby module. Keeps the upstream DocuSeal attribution required by AGPLv3 §7(b) in the powered-by footer, email attribution, README, and a new NOTICE file. Migration renames the AATL cert identifier in encrypted configs from docuseal_aatl to wabosign_aatl. Removes multitenant-gated Pro upsell UI (Plans/Console/Upgrade links, SMS/SSO/bulk-send/logo placeholders, reminder-duration restriction, the "DocuSeal Pro" email-attribution toggle, conditions/formula/payment pricing links) so every shipped feature is reachable on a self-hosted deployment. Multitenant routing logic is preserved. Drops Discord, Twitter, and ChatGPT/AI-assistant chrome. Embedding modal keeps the upstream <docuseal-form> / @docuseal/* SDK contract so existing embedded forms continue to work; documented in NOTICE. REBRANDING.md captures the change inventory for future maintainers. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	1 month ago
Alex Turchyn	7b5494468f	update rails to 8.1.2	5 months ago
Pete Matsyburka	8c2475aac1	add gh action timouts	12 months ago
Pete Matsyburka	f78cf8cc6e	pdfium	1 year ago
Pete Matsyburka	c133fef99d	ruby 3.4.2	1 year ago
Alex Turchyn	b65bca213f	add brakeman to CI	1 year ago
Pete Matsyburka	9f4f868246	use erb_lint	1 year ago
Pete Matsyburka	0b3ca0de96	fix ci	1 year ago
Pete Matsyburka	b950b1c63e	ruby 3.4.1	2 years ago
Pete Matsyburka	25fe35e212	ruby 3.3.4	2 years ago
Pete Matsyburka	cd9c3ee3c1	fix ci	2 years ago
Pete Matsyburka	f1d6bbdc67	fix ci	2 years ago
Pete Matsyburka	2e597fcf43	ruby 3.3.1	2 years ago
Pete Matsyburka	e9277f4eeb	use node 20 in GH actions	2 years ago
Alex Turchyn	dc7593c70c	fix GitHub CI build	3 years ago
Alex Turchyn	f6879d7f94	fix GitHub CI	3 years ago
Alex Turchyn	ff18fef2e3	configure GitHub actions	3 years ago

20 Commits (1edc41c9818e5948668f93821056ca8d0ade6f4e)