Rotimi Best
25d1a8d710
Security Release v0.2.6: Email Verification Bypass Vulnerabilities Fixed
...
Critical security fixes addressing email verification bypass vulnerabilities:
Security Issues Fixed:
- Email verification status manipulation through client-side profile updates
- Base64 token forgery allowing arbitrary email verification
- DOM manipulation bypasses of email verification modal
Backend Security Enhancements:
- Secure verification tokens table with cryptographic token generation
- RLS policies preventing direct email verification status changes
- Server-side validation functions with expiration and ownership checks
- Database triggers blocking unauthorized verification status updates
- IP address logging and audit trails for security monitoring
Frontend Security Protections:
- Multi-layered DOM protection preventing UI manipulation bypasses
- Continuous monitoring and re-application of interaction restrictions
- CSS-based backup protection even if JavaScript is disabled
- Mutation observer to protect dynamically added elements
- Enhanced CSP configuration for Senja widget support
API Security Updates:
- Secure token-based verification replacing insecure Base64 method
- Comprehensive error handling with security-focused user messages
- Token validation with signature verification and expiration checks
- Legacy verification method blocking with security warnings
- Enhanced verification email generation with secure tokens
Files Modified:
- Database: New email_verification_tokens table and security functions
- API: Secure verification endpoints with token validation
- Frontend: DOM protection and verification modal enhancements
- CSP: Updated Content Security Policy configuration
- Blog: Security advisory for CVE-2025-65675 disclosure
This release patches critical authentication bypass vulnerabilities and
implements defense-in-depth security measures across the entire platform.
Security researchers and users should upgrade immediately.
2025-12-03 15:33:04 +01:00
Rotimi Best
fb2ea885e1
chore: update translation
2025-12-03 10:59:08 +01:00
Nwosu Emmanuel
8efffcb7f6
feat: clone course ( #582 )
...
* feat: clone course work
* feat: clone and delete a course
* feat: clone and delete a course
* feat: clean up
* feat: attending to reviews
* feat: attended to revies
2025-10-29 09:57:29 +01:00
Adeyemi Adetunji
f8271d850f
fix: dashboard i18n build/console warnings ( #587 )
...
* fix: build warnings
* feat: remove other instances of invalid_type_error and the unused translation key
2025-10-29 09:34:30 +01:00
Adeyemi Adetunji
b9b19d8a2e
feat: add search and replace to tinymce editor ( #585 )
2025-10-28 11:59:21 +01:00
Adeyemi Adetunji and Rotimi Best
3692046077
feat: add danish support to dashboard ( #580 )
...
* feat: Add Danish Support
* feat: add migration file
* chore: update migrations
---------
Co-authored-by: Rotimi Best <[email protected]
2025-10-13 18:07:46 +01:00
Rotimi Best