Miguel Ribeiro 800241a265 Fix GHSA-q2r8-m9wm-5547: escape iCal property values to prevent CRLF injection ...

Raw CRLF in subscription name/notes/url passes through validate()
untouched (it only escapes HTML metacharacters) and was interpolated
directly into .ics VEVENT properties, letting an unescaped newline
terminate the current property and inject arbitrary calendar events.

Adds includes/ical_helper.php::icalEscape() (RFC 5545 value escaping)
and applies it to every user-controlled value embedded in both
iCal export endpoints, rather than stripping newlines in the shared
validate() sanitizer (which would break legitimate multi-line notes
used elsewhere in the app).

2026-07-11 23:27:59 +02:00

..

add.php

feat!: complete ui overhaul

2026-07-11 17:31:46 +02:00

clone.php

fix: harden oidc state validation and session rotation (#1071)

2026-06-23 00:17:18 +08:00

delete.php

feat: enforce CSRF protection and POST-only policy across endpoints (#940)

2025-10-18 23:58:50 +02:00

exportcalendar.php

Fix GHSA-q2r8-m9wm-5547: escape iCal property values to prevent CRLF injection

2026-07-11 23:27:59 +02:00

get.php

feat: add some leeway for totp codes

2024-11-17 16:27:48 +01:00

getcalendar.php

fix: allow usernames with capital letters

2024-07-29 13:57:20 +02:00

renew.php

fix: null array on empty subscription list

2026-05-17 00:54:14 +02:00