31 Commits

Author SHA1 Message Date
Miguel Ribeiro
aff3ed06b1 feat: add OIDC_REQUIRE_EMAIL_VERIFIED environment variable and SSRF_ALLOWLIST environment variable
feat: add Arabic localization
feat: add manual logo search box and png prioritization
fix: pin discord notification action to a commit sha
fix: service worker caching stale logo search results and broken images as logos
fix: ai recommendations not handling varied provider responses
fix: deleting orphaned logos not taking into account themed variants
fix: stats page not using themed logo variants
fix: email notification test rejecting non-admin users
fix: notification test/send requests hanging on unreachable hosts
fix: progress bar showing 100% when next payment is more than one cycle away
2026-07-18 23:33:40 +02:00
Jonathan Rehm
de59c1e6c6 add SSRF_ALLOWLIST environment variable (#1123)
By allowing this to be set via environment variable, we are one step
closer to OIDC being available immediately on initial start-up.
2026-07-18 19:41:11 +02:00
Jonathan Rehm
69037fe0f4 add OIDC_REQUIRE_EMAIL_VERIFIED environment variable (#1122) 2026-07-18 19:34:20 +02:00
Miguel Ribeiro
8d22f04353 feat: create dark and light theme versions of the logos when removing background
fix: ajax calls after session expired
refactor: remove imagick dependency
2026-07-13 00:36:09 +02:00
Miguel Ribeiro
11eaf402e8 feat!: complete ui overhaul (#1108)
feat: option for the week to start on sunday
feat: redesign login / registration pages
feat: more statistics
feat: declarative oidc settings
feat: grid view for subscriptions
feat: subscription details popup
feat: translate categories with ai
feat: google image search with serpapi
feat: selfh.st image search
feat: dashboard icons image search
fix: improve background removal feature for logos
feat: v2.0 api - write endpoints
fix: include todays subscriptions on amount due this month
fix: calendar occurrences to respect subscription start date
fix: honor configured outbound proxy for logo search without reopening httpoxy SSRF bypass
fix: remove hardcode string from the admin page
fix: ssrf via http proxy env var in payments logo search
fix: require cron auth guard on storetotalyearlycost.php
fix: validate per-user smtp host against ssrf
fix: escape iCal property values to prevent crlf injection
2026-07-11 23:54:52 +02:00
Ali Khattab
b9567c3d2e Add declarative OIDC (#1056)
* feat(oidc): add declarative runtime configuration

* feat(admin): reflect env-managed oidc settings

* docs(oidc): document environment variables

* chore: match repo line endings and dedupe compose comment

---------

Co-authored-by: Miguel Ribeiro <k.d.mitnick@gmail.com>
2026-07-09 22:54:12 +02:00
Miguel Ribeiro
b75f13d0ff fix: harden oidc state validation and session rotation (#1071)
fix: account takeover via email-based account linking
fix: missing fields when cloning a subscription
fix: ssrf via oidc token/userInfo url configuration
fix: ssrf via test email notification
fix: zip slip path traversal in database restore writes files to webroot
2026-06-23 00:17:18 +08:00
Miguel Ribeiro
0fef9597ef fix: null array on empty subscription list
fix: don't use mbstring
feat: sort graphs on the statistics page by usage
feat: lifetime subscriptions
feat: allow multiple filters on the settings page
feat: filter by notification status
fix: migrations using double quotes
feat: rework icons
fix: open 3 dot menu abone for the subscriptions at the bottom
fix: ntfy notifications with strange chars
2026-05-17 00:54:14 +02:00
Miguel Ribeiro
d4725f36bd fix: cases on private endpoints where self-xss was possible (#1045) 2026-04-26 14:04:53 +02:00
Miguel Ribeiro
99c30e70c8 feat: add openai compatible host for ai recommendations
feat: move update banner to the dashboard
fix: handle some ai responses that come in a different format
chore: handle deprecation of curl_close
feat: enable ai recommendations at a schedule
2026-03-23 16:24:26 +00:00
Miguel Ribeiro
e8a513591d fix: ssrf vulnerability on all test notifications endpoint
fix: xss vulnerability on password reset page
fix: vulnerability allowed to delete avatars from other users
chore: bump version
2026-03-05 23:13:51 +01:00
Dmitry
b99a07cc5c add autocomplete attribute for inputs (#926) 2025-10-12 12:52:10 +02:00
Miguel Ribeiro
3ecc160ccb fix: redirect from dashboard to subscriptions for new users
fix: wrong check for disabling password login
fix: missing apikey validation error on get_monthly_cost api endpoint
chore: update readme
2025-08-13 13:55:31 +02:00
Miguel Ribeiro
ba6dddf526 feat: add at a glance dashboard
fix: accept both api_key and apiKey as parameter on the api
feat: allow to disable password login when oidc is enabled
feat: add get_oidc_settings endpoint to the api
feat: refactor css colors
feat: ai recommendations with chatgpt, gemini or ollama
feat: display ai recommendations on the dashboard
2025-08-12 00:48:13 +02:00
Miguel Ribeiro
c0d53e4423 feat: add oauth/oidc support (#873) 2025-07-21 22:53:35 +02:00
Igor Rzegocki
153a6a48c0 support for relays without authentication and encryption (#662) 2024-12-20 21:47:25 +00:00
Miguel Ribeiro
5e6bc903bc feat: add payment cycle to csv/json export
feat: run db migration after restoring database
feat: run db migration after importing db
feat: store weekly the total yearly cost of subscriptions
fix: double encoding in statistics labels
2024-12-12 00:09:51 +01:00
Miguel Ribeiro
3f33ba0310 fix: inline items in subscription form out of place (#489) 2024-08-11 09:30:10 +02:00
Miguel Ribeiro
1946ac9855 feat: admin can manually trigger cronjobs
fix: only allow the system and admin to run the cronjobs
fix: reduce size of the log files of the cronjobs
2024-08-09 15:56:12 +02:00
Miguel Ribeiro
0274b1d525 fix: deprecation message for null value (#479) 2024-08-06 22:13:14 +02:00
Miguel Ribeiro
3281f0ce35 feat: add option to list disabled subscriptions at the bottom
feat: notification for wallos version updates
2024-08-06 15:11:50 +02:00
Miguel Ribeiro
a539058025 fix: use the same font for inputs 2024-07-11 14:04:10 +02:00
Miguel Ribeiro
e2e5061d15 fix: error when logos folder is empty (#439) 2024-07-10 18:18:35 +02:00
Miguel Ribeiro
9f7f47b5d1 feat: add maintenance tasks to admin page
feat: add support to upload svg logos
2024-07-09 18:45:23 +02:00
Miguel Ribeiro
c166c7e84c feat: uniformize layout and styles (+ checkboxes and radios) (#423) 2024-07-04 21:15:47 +02:00
Miguel Ribeiro
83e2066e7b feat: theming engine custom colors now affect icons as well 2024-06-30 21:49:14 +02:00
Miguel Ribeiro
6d2ffa6312 feat: create users from the admin page (#409) 2024-06-27 00:05:37 +02:00
Miguel Ribeiro
c2e85d6e10 feat: support automatic dark mode
refactor: run linter and cleanup php files
fix: not every payment cycle was shown on the calendar
feat: also show previous payments on the calendar for the current month
2024-06-26 18:11:37 +02:00
Miguel Ribeiro
092be22183 feat: add hability to disable login (#378) 2024-06-08 00:04:50 +02:00
Miguel Ribeiro
e1006e5823 feat!: allow registration of multiple users (#340)
feat: administration area
feat: add reset password functionality
2024-05-26 23:30:51 +02:00
Miguel Ribeiro
f1815d7335 chore: add support for rtl languages (#331) 2024-05-18 17:41:01 +02:00