[pull] master from YOURLS:master by pull[bot] · Pull Request #36 · caesar-team/YOURLS

pull · 2022-02-09T05:36:14Z

See Commits and Changes for more details.

Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

Considering the change of the address of the blog page, why not update the link? And also the new link have SSL.

Co-authored-by: ozh <ozh@users.noreply.github.com>

Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.27.1 to 2.28.0. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@2.27.1...2.28.0) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: ozh <ozh@users.noreply.github.com>

Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.28.0 to 2.29.0. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@2.28.0...2.29.0) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: ozh <ozh@users.noreply.github.com>

Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 5 to 6. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@v5...v6) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.29.0 to 2.30.0. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@2.29.0...2.30.0) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: ozh <223647+ozh@users.noreply.github.com>

Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.30.0 to 2.30.1. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@2.30.0...2.30.1) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.30.1 to 2.30.2. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@2.30.1...2.30.2) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.30.2 to 2.30.3. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@2.30.2...2.30.3) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.30.3 to 2.30.4. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@2.30.3...2.30.4) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

PHPDoc comments about the API response format say that both `statusCode` and `errorCode` are expected to be strings, but a lot of cases were returning ints instead. This could cause problems for JSON clients.

Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.30.4 to 2.30.5. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@2.30.4...2.30.5) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.30.5 to 2.31.0. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@2.30.5...2.31.0) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.31.0 to 2.31.1. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@2.31.0...2.31.1) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 6 to 7. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@v6...v7) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.31.1 to 2.32.0. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@2.31.1...2.32.0) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: Léo Colombaro <LeoColomb@users.noreply.github.com>

…ted (#4133)

New logic : if YOURLS_COOKIEKEY isn't defined, or is a publicly known value, die.

@5ud0er

* Introduce test scenarios for consts * Restrict remote title fetch to public hosts for anonymous users * Add tests Hat tip: @5ud0er for reporting the issue in the first place

@web-hacker-team

* Add expected-to-fail tests for path-traversal attacks into pages * Forbid '..' in pages * Harden yourls_get_request() Co-authored-by: dgw <dgw@technobabbl.es> Hat tip @web-hacker-team

* Fix content-type edge cases when fetching titles * Remove the @ operators Fixes #4143

* SSRF & local IP followup Damn I learned a whole lot about IP adresses and how IPv6 tries _way too hard_ to make friends with IPv4 :) * Add note about DNS rebinding So that future security experts using Claude will not submit advisories or PR about this. * More PHP 8.1 8.2 vs 8.3 discrepancies `2001:db8::1` is rejected on 8.1 & 8.2, not after. Dropping the entry rather than checking PHP ver.

* Update CHANGELOG for version 1.10.5 Co-authored-by: Léo Colombaro <LeoColomb@users.noreply.github.com>

* Update CHANGELOG * Update YOURLS version to 1.10.6 Fixes #4155

Bump YOURLS version to 1.10.7-dev

Close #4167

Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.37.2 to 2.40.0. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@2.37.2...2.40.0) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-version: 2.40.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

pull Bot added the ⤵️ pull label Feb 9, 2022

pull Bot added the merge-conflict Resolve conflicts manually label Feb 16, 2022

mohammadshg84 and others added 28 commits November 24, 2023 07:36

Update readme.html (#3669)

af4ec44

Considering the change of the address of the blog page, why not update the link? And also the new link have SSL.

Update GeoIP DB (#3656)

ba3fce2

Co-authored-by: ozh <ozh@users.noreply.github.com>

Update certificates (#3612)

e9158d0

Co-authored-by: ozh <ozh@users.noreply.github.com>

Update GeoIP DB (#3672)

b493c47

Co-authored-by: ozh <ozh@users.noreply.github.com>

Update GeoIP DB (#3689)

8bfa95b

Co-authored-by: ozh <ozh@users.noreply.github.com>

Update certificates (#3690)

e0c7fc9

Co-authored-by: ozh <ozh@users.noreply.github.com>

Update GeoIP DB (#3713)

2c6a6b1

Co-authored-by: ozh <223647+ozh@users.noreply.github.com>

Ensure all statusCode/errorCode API values are strings (#3756)

469763c

PHPDoc comments about the API response format say that both `statusCode` and `errorCode` are expected to be strings, but a lot of cases were returning ints instead. This could cause problems for JSON clients.

Update certificates

a0be3a5

Update GeoIP DB

5509cc9

Update CI badge syntax

66dd831

Upgrade Aura.SQL to fix PHP 8.4 compatibility (#3852)

e1359e4

Co-authored-by: Léo Colombaro <LeoColomb@users.noreply.github.com>

Upgrade dependencies to match PHP 8.1+ requirement

b930019

Upgrade tests to PHPUnit 10+

0ea6cd9

Reflect PHP requirement into docs

e4012d3

TowyTowy and others added 30 commits July 10, 2026 22:57

Return HTTP 409 Conflict (not 400) when a duplicate long URL is rejec…

3c69b67

…ted (#4133)

Update GeoIP DB

f2a1d0b

Update GeoIP DB

6469f55

Update certificates

35aa738

Update GeoIP DB

3f3d0d5

Make YOURLS_COOKIEKEY unpredictable (#4139)

cd307e9

New logic : if YOURLS_COOKIEKEY isn't defined, or is a publicly known value, die.

Update GeoIP DB

2c0bd54

Restrict remote title fetch to public hosts for anonymous users (#4141)

410274c

* Introduce test scenarios for consts * Restrict remote title fetch to public hosts for anonymous users * Add tests Hat tip: @5ud0er for reporting the issue in the first place

Fix for path traversal in pages (#4142)

4e85972

* Add expected-to-fail tests for path-traversal attacks into pages * Forbid '..' in pages * Harden yourls_get_request() Co-authored-by: dgw <dgw@technobabbl.es> Hat tip @web-hacker-team

Update GeoIP DB

54eda57

Fix content-type edge cases when fetching titles (#4147)

f076ab2

* Fix content-type edge cases when fetching titles * Remove the @ operators Fixes #4143

Update GeoIP DB

af85478

Update certificates

33de884

Update CHANGELOG for version 1.10.5 (#4152)

f235ee3

* Update CHANGELOG for version 1.10.5 Co-authored-by: Léo Colombaro <LeoColomb@users.noreply.github.com>

Update GeoIP DB

f0b8a61

1.10.6 (#4156)

8220c8d

* Update CHANGELOG * Update YOURLS version to 1.10.6 Fixes #4155

1.10.7-dev (#4158)

e44db29

Bump YOURLS version to 1.10.7-dev

Update GeoIP DB

b0d03a0

Update GeoIP DB

be179cf

Update GeoIP DB

90ad5b8

Update GeoIP DB

5ee1d3a

Update GeoIP DB

aef4b15

Update certificates

7e944ae

Replace jakeasmith/http_build_url with ozh/http_build_url (#4176)

cf398be

Close #4167

Update GeoIP DB

9add235

Show referrers to logged in users on public stats (#4173)

2a1d070

Update GeoIP DB

38a2ae8

Update GeoIP DB

69cb963

Navigation Menu

Repository navigation

[pull] master from YOURLS:master - #36

[pull] master from YOURLS:master#36
pull[bot] wants to merge 385 commits into
caesar-team:masterfrom
YOURLS:master

pull Bot commented Feb 9, 2022 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

18 participants

Conversation

pull Bot commented Feb 9, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

18 participants

pull Bot commented Feb 9, 2022 •

edited

Loading