Commit Graph
290 Commits
Author SHA1 Message Date
Rotimi Best 25d1a8d710 Security Release v0.2.6: Email Verification Bypass Vulnerabilities Fixed
Critical security fixes addressing email verification bypass vulnerabilities:

Security Issues Fixed:
- Email verification status manipulation through client-side profile updates
- Base64 token forgery allowing arbitrary email verification
- DOM manipulation bypasses of email verification modal

Backend Security Enhancements:
- Secure verification tokens table with cryptographic token generation
- RLS policies preventing direct email verification status changes
- Server-side validation functions with expiration and ownership checks
- Database triggers blocking unauthorized verification status updates
- IP address logging and audit trails for security monitoring

Frontend Security Protections:
- Multi-layered DOM protection preventing UI manipulation bypasses
- Continuous monitoring and re-application of interaction restrictions
- CSS-based backup protection even if JavaScript is disabled
- Mutation observer to protect dynamically added elements
- Enhanced CSP configuration for Senja widget support

API Security Updates:
- Secure token-based verification replacing insecure Base64 method
- Comprehensive error handling with security-focused user messages
- Token validation with signature verification and expiration checks
- Legacy verification method blocking with security warnings
- Enhanced verification email generation with secure tokens

Files Modified:
- Database: New email_verification_tokens table and security functions
- API: Secure verification endpoints with token validation
- Frontend: DOM protection and verification modal enhancements
- CSP: Updated Content Security Policy configuration
- Blog: Security advisory for CVE-2025-65675 disclosure

This release patches critical authentication bypass vulnerabilities and
implements defense-in-depth security measures across the entire platform.

Security researchers and users should upgrade immediately.
2025-12-03 15:33:04 +01:00
Rotimi Best 43e6cd611d chore: auto logout test emails. 2025-12-03 13:48:25 +01:00
Rotimi Best 900f5ec129 fix: critical SVG XSS vulnerability in file uploads
- Add comprehensive file type validation to prevent SVG uploads
- Update upload widgets to restrict file types at input level
- Enhanced HTML sanitization to block SVG tags and data URLs
- Create centralized file validation utilities with shared constants
- Add client-side and server-side protection against malicious uploads

Security Impact:
- Prevents stored XSS attacks through malicious SVG profile uploads
- Blocks execution of JavaScript embedded in SVG files
- Enforces whitelist of safe image formats (JPEG, PNG, GIF, WebP)
- Provides defense-in-depth protection across all upload components

Fixes reported vulnerability in profile image upload functionality.
2025-12-03 11:25:00 +01:00
Rotimi Best fb2ea885e1 chore: update translation 2025-12-03 10:59:08 +01:00
Rotimi Best 07ecfcf967 fix: authorization bypass vulnerabilities in plan-restricted features
- Add plan validation to custom domain saving (Domains.svelte)
- Add plan validation to certificate customization (Design.svelte)
- Add plan validation to document upload (AddDocumentToLesson.svelte)
- Add plan validation to video upload (UploadVideo.svelte)
- Enhance team member function validation (TeamMembers.svelte)

Prevents free users from bypassing UI restrictions via DOM manipulation.
All restricted functions now enforce server-side plan validation.
2025-12-03 10:01:50 +01:00
Rotimi Best 7b18c325da fix: cross site scripting with html content 2025-12-03 09:33:53 +01:00
Rotimi Best 1e966aaf0f fix: redirect to 404 page after user closes welcome modal.
This is because when you close the modal we redirect you to /org/siteName/courses but if you click close before we get your organization siteName the route is just /courses which redirects to a 404.
2025-11-18 19:16:51 +01:00
Rotimi Best b8c15eabe3 chore: remove debug console log from app.svelte
Removed console log for global store in app.svelte.
2025-11-08 20:20:38 +01:00
Rotimi Best 34e5cab733 chore: [FIXED] clean up console logs in layout and pricing components, add context prompt for ClassroomIO
This point I have fixed 2 major issues
1. After signing in with Google auth, join a course and going to the course, when you click the back button in the page nav, it takes you to admin instead of lms

2. When you open a course landing page, click enroll, it redirects to 404 instead of the invite page.
2025-11-08 18:47:53 +01:00
Rotimi Best b783940cee fix: keep org store after logout
This fix tackled a bug where if I logged out, go to org landing page, open a course and enrol then it gets redirected to a 404 page because `$currentOrg.siteName` is undefined.
2025-11-08 17:58:03 +01:00
Rotimi Best 93db0c97e8 chore: use hasSession to check if auth token exists 2025-11-08 17:30:22 +01:00
Rotimi Best 0f433cfa93 chore: debug enrollment on lms 2025-11-08 06:11:44 +01:00
Rotimi Best 291e233700 chore: enable auto redirect on layout mount
The use case for this is that if a person went from course page to invite page, and isn't authenticated then the user should be redirected to login page with a redirect query param
2025-11-08 05:02:17 +01:00
Rotimi Best 570b809111 chore: debug join course 2025-11-08 04:52:42 +01:00
Rotimi Best 86adad9358 fix: onboarding validation error showing translation key #586 (#593)
* fix: onboarding validation error showing translation key #586

* fix: remove debug log for profile update errors
2025-11-01 09:54:19 +01:00
Adeyemi Adetunji 97fb446df5 fix: snackbar for profile component (#588) 2025-10-31 18:28:52 +01:00
Nwosu Emmanuel 8efffcb7f6 feat: clone course (#582)
* feat: clone course work

* feat: clone and delete a course

* feat: clone and delete a course

* feat: clean up

* feat: attending to reviews

* feat: attended to revies
2025-10-29 09:57:29 +01:00
Adeyemi Adetunji f8271d850f fix: dashboard i18n build/console warnings (#587)
* fix: build warnings

* feat: remove other instances of invalid_type_error and the unused translation key
2025-10-29 09:34:30 +01:00
Adeyemi Adetunji b9b19d8a2e feat: add search and replace to tinymce editor (#585) 2025-10-28 11:59:21 +01:00
Adeyemi AdetunjiandRotimi Best 3692046077 feat: add danish support to dashboard (#580)
* feat: Add Danish Support

* feat: add migration file

* chore: update migrations

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-10-13 18:07:46 +01:00
Rotimi Best c31e5e131f chore: update org mock data 2025-10-13 15:49:50 +01:00
Rotimi Best 23ef0661eb fix: add address translation to en.json 2025-10-13 15:46:28 +01:00
Rotimi Best c34379f6a2 chore: set default of customLinks 2025-10-13 15:35:02 +01:00
Nwosu Emmanuel 6cae0f1506 fix: pushed fix for landing page (#579) 2025-10-13 14:39:57 +01:00
Rotimi Best ab89837e29 chore: align logo on org landing page 2025-10-12 17:43:43 +01:00
Rotimi Best 92cc922a40 chore: reorder org import 2025-10-12 17:30:39 +01:00
Rotimi Best 41de98083f fix: show navigation if slugname include routes to hide nav 2025-10-12 14:02:47 +01:00
Nwosu EmmanuelandRotimi Best 27ee51155e feat: add custom navigation link to org landing page (#569)
* feat: custom navbar UI complete

* chore: added translations

* fear: attending to reviews

* add orgname to org landing page

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-10-09 01:13:06 +01:00
Rotimi Best 9a7018eb34 chore: remove unused dependencies 2025-10-04 11:01:22 +01:00
Nwosu EmmanuelandRotimi Best 594eb97caa feat: AI grading bug (#420)
* worked on the AI grading task

* worked on the AI grading task

* improved the ai grading function

* improved the ai grading function

* update types

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-09-28 20:08:56 +01:00
Rotimi Best 2c3ee88e13 chore: move course analytics a step after content 2025-09-21 20:44:30 +01:00
Rotimi Best 6d68351a46 feat: end to end api type safety with redis rate limiting (#573)
* feat: support hono rpc

* add wrangler file

* update name of wrangler file

* add wrangler as a dependency

* add compatibility_flags

* trigger ci

* core: add health check to docker file

* expose port 80

* update custom healthcheck

* feat: implement openapi

* install dependencies in root

* debug yml

* update yml

* update port

* update dockerfile with envs

* completely move away from apiClient

* rename backend to api

* refactor: update server descriptions and comment out local spec saving

* update lock file

* use api.classroomio.com

* add support for redis

* fix: add missing line break in WelcomeModal.svelte

* refactor: remove wrangler configuration and update Vite config for API integration
2025-09-21 19:35:41 +01:00
Rotimi Best a6880f1b54 feat: implement percentage calculation utility and refactor analytics to use it
- Added `calcPercentageWithRounding` function for consistent percentage calculations with rounding.
- Updated course and user analytics to utilize the new utility for progress and average grade calculations.
- Removed redundant rounding logic from analytics functions.
2025-09-18 10:34:54 +01:00
Nwosu EmmanuelandRotimi Best ec3875bac2 feat: course analytics (#574)
* feat: added anaytics for the course page

* feat: Added pagination

* feat: cleanup

* feat: added translations

* feat: added fixes

* my improvements

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-09-18 01:00:49 +01:00
Nwosu Emmanuel f3de6a063e feat: Trigger confirm warning for unsaved changes (#547)
* added the triger warning for the settings page

* all done

* added translation to the window message

* window issue now fixed
2025-09-16 09:21:41 +01:00
Rotimi Best caa48003af fix: include types 2025-09-15 19:15:50 +01:00
Rotimi Best fb0131de2d fix: load documents on client 2025-09-15 19:14:22 +01:00
Rotimi Best a078971064 fix: update loading state variable for input fields in invite page 2025-09-10 21:12:50 +01:00
Rotimi Best 98acd93133 fix: disable accept button if still fetching user details 2025-09-10 20:39:16 +01:00
Rotimi Best f63b3021f6 feat: enhance AuthUI with redirectPathname prop for improved navigation 2025-09-10 18:49:50 +01:00
Rotimi Best 06de8d44b8 chore: add orgname to org landing page header 2025-09-10 18:17:27 +01:00
Rotimi Best f60809a249 fix: only redirect in layout only if on redirect page 2025-09-10 17:18:01 +01:00
Rotimi Best 12c0f00007 debug: auth redirect 2025-09-10 16:50:31 +01:00
Nwosu EmmanuelandRotimi Best 937f1d8155 feat: add documents to Lesson materials (#572)
* feat: Initial logic for the pdf upload

* feat: uploa logic, translations and ui flow complete

* chore:console log cleanup

* feat: fixed upload issue and added cancel upload button

* feat: fixing the download document ish

* feat: All done and ready for use

* feat: updated the document viewing logic

* feat: some minor refactor

* feat: added migration file

* fix: dark mode, translations, restyling,

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-09-10 11:39:06 +01:00
Rotimi Best 7a77bd6c79 chore: check permission only after org is loaded 2025-09-09 13:12:56 +01:00
Rotimi Best c421ec29d9 chore: add custom domain validation for classroomio.com 2025-09-07 16:44:32 +01:00
Rotimi Best 9055c45384 chore: move IS_SELFHOSTED to public env 2025-09-07 10:24:34 +01:00
Rotimi Best 7dfabf6e7f fix: center tooltip text 2025-08-27 22:21:03 +01:00
Rotimi Best 392e1abd1f fix: allow user navigate to profile settings after coming to org settings first 2025-08-23 00:35:29 +01:00
Rotimi Best 279d10a914 feat: add Polish language support 2025-08-08 04:53:38 +01:00