97 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Stefan Bethke	6ec1b9fc5a	fix: Builds images with kaniko ... There are no Windows runners; build the images with kaniko in a container on the `docker` runner, as on the link-updates branch, while keeping the publishing restrictions: - only pushes to refs/heads/main publish, as `latest` and `sha-<commit>` - other refs build with --no-push under a ci-<commit> tag - registry credentials are only passed to the build when publishing The docker compose smoke test is dropped, as there is no Docker daemon inside the kaniko container.	2026-11-15 11:48:03 +01:00
Stefan Bethke	3211e0f355	Merge remote-tracking branch 'origin/main' into security-fixes	2026-11-15 11:45:52 +01:00
stb	b019a47539	Merge pull request 'Support and documentation for camera:type=panorama' (#30) from panorama-camera into main ... Reviewed-on: #30	2026-11-15 11:38:08 +01:00
stb	7f1750c240	Merge branch 'main' into panorama-camera	2026-11-15 11:37:25 +01:00
Stefan Bethke	cdf90a04d3	fix: Corrects country code check in statistics filter ... Operator precedence made the check always true; it now accepts two capital letters or '--' as intended.	2026-11-15 11:36:49 +01:00
Stefan Bethke	3b28280333	fix: Escapes generated SQL and validates sequence number ... create_camera_update_statements.php wrote OSM tag keys and values unescaped into /migrations/*.sql. Values are now escaped and node ids cast to int. The sequence number argument must be numeric and is bound as a parameter instead of being concatenated into SQL and the output path.	2026-11-15 11:36:49 +01:00
Stefan Bethke	189105075c	fix: Publishes images only from main ... Every pushed ref built and pushed images, with the tag derived from the ref name. A branch named "latest" or a git tag named "main" therefore overwrote the production image, and ref names were interpolated into shell scripts unquoted (script injection). - images are only pushed for pushes to refs/heads/main - other refs are built and tested with a ci-<sha> tag, never pushed - registry login happens only when publishing, after the compose test - main additionally pushes an immutable sha-<sha> tag for pinning - expression values are passed to scripts via env The registry credentials still need to be restricted to main on the Forgejo side, since a pushed branch can modify this workflow.	2026-11-15 11:36:49 +01:00
Stefan Bethke	344232fb75	fix: Hardens web container ... - document root is owned by root and not writable by www-data (the base image ships /var/www/html as www-data with mode 1777) - uses php.ini-production, so errors are not shown to clients - disables directory listings, expose_php and the detailed server signature	2026-11-15 11:36:49 +01:00
Stefan Bethke	6a64083175	fix: Escapes location search results ... Nominatim results were inserted via innerHTML and loaded as a JSONP script with an unencoded query. Results are now fetched as JSON, the query is URL encoded, text is escaped and coordinates must be numeric.	2026-11-15 11:36:49 +01:00
Stefan Bethke	100762ea2e	fix: Escapes OSM tag data in camera popups ... camera.php built its JSON by hand with htmlentities(), which leaves backslashes intact, and the client parsed it with eval() and inserted tag values into the popup as HTML. A tag value such as <img ...> therefore became live markup (stored XSS for anyone able to edit OSM data), and a lone backslash broke parsing of the whole response. - camera.php now builds the response with json_encode() and returns raw values - tags named lat, lon, id, count, multi or poly no longer override the fields set by the server - error responses no longer include database error messages - the client uses JSON.parse() and escapes all keys and values; only http(s) URLs are rendered as links/images	2026-11-15 11:36:49 +01:00
stb	2161baa579	Merge pull request 'Update docker/login-action action to v4' (#31) from renovate/docker-login-action-4.x into main ... Reviewed-on: #31	2026-11-15 11:34:08 +01:00
stb	897a497c8e	Merge pull request 'Update docker/setup-buildx-action action to v4' (#32) from renovate/docker-setup-buildx-action-4.x into main ... Reviewed-on: #32	2026-11-15 11:33:57 +01:00
stb	2bf415c94e	Merge pull request 'Update quay.io/fedora/fedora-minimal Docker tag to v46' (#35) from renovate/quay.io-fedora-fedora-minimal-46.x into main ... Reviewed-on: #35	2026-11-15 11:33:44 +01:00
stb	a0cab66dbd	Merge pull request 'Update actions/checkout action to v7' (#34) from renovate/actions-checkout-7.x into main ... Reviewed-on: #34	2026-11-15 11:33:30 +01:00
stb	3eeb33a91d	Merge pull request 'Update mariadb Docker tag to v13' (#36) from renovate/mariadb-13.x into main ... Reviewed-on: #36	2026-11-15 11:33:17 +01:00
Renovate	5ffed66449	Update mariadb Docker tag to v13	2026-09-16 00:19:37 +00:00
Renovate	90a314acf1	Update quay.io/fedora/fedora-minimal Docker tag to v46	2026-08-13 02:31:58 +00:00
Renovate	2a0960c2d5	Update actions/checkout action to v7	2026-06-18 15:02:02 +00:00
Vincent Mahnke	67bfaff4d6	chore: Replaces port to allow testing on Windows agent	2026-03-22 17:50:52 +01:00
Vincent Mahnke	209f9105bd	chore: Switch to non-deskop runner	2026-03-22 17:31:54 +01:00
Vincent Mahnke	4a304d1bc5	fix: Switches to buildx	2026-03-22 16:49:54 +01:00
Vincent Mahnke	75840bb99f	chore: Move to fedora-latest runner	2026-03-22 16:18:50 +01:00
Vincent Mahnke	42f7456e18	fix: Panoramic camera details can be shown	2026-03-20 19:20:14 +01:00
Vincent Mahnke	df45b9bbc4	fix: Adds missing localization	2026-03-20 19:17:31 +01:00
Vincent Mahnke	0a3b543796	fix: Handles panorama cameras inside statistics	2026-03-20 19:17:18 +01:00
Vincent Mahnke	6ab393b2af	feat: Adds frontend logic to render camera:type=panorama	2026-03-20 17:42:00 +01:00
Vincent Mahnke	4b5811d951	feat: Adds images for camera:type=panorama	2026-03-20 17:41:59 +01:00
Renovate	6434bf5cf4	chore(deps): update docker/setup-buildx-action action to v4	2026-03-10 20:01:57 +00:00
Renovate	2343dd03eb	chore(deps): update docker/login-action action to v4	2026-03-10 20:55:41 +01:00
Vincent Mahnke	954b534b10	fix: Handles pushed to all branches	2026-03-10 20:55:27 +01:00
Vincent Mahnke	17c6946361	fix: Resolves syntax error	2026-03-10 20:54:46 +01:00
Vincent Mahnke	8775e3fc17	fix: Changes to docker pool	2026-03-10 20:53:02 +01:00
ViMaSter	9138d57429	Excludes tag= from replacement	2025-10-25 17:53:03 +02:00
ViMaSter	9cf8cffee4	fix: Replace invalid docker tag characters with underscore	2025-10-25 17:53:03 +02:00
asohh	afc3828575	Merge pull request 'renamed db-user to CAMERA_SELECT_USER' (#22) from sunders-18 into main ... Reviewed-on: #22 Reviewed-by: Vincent Mahnke <vimaster@noreply.git.hamburg.ccc.de>	2025-10-25 17:52:29 +02:00
asohh	3b92dbade7	renamed db-user to CAMERA_SELECT_USER	2025-10-25 17:46:37 +02:00
asohh	b3a38df17a	Merge pull request 'added impressum as a var' (#20) from impressum-as-var into main ... Reviewed-on: #20 Reviewed-by: Vincent Mahnke <vimaster@noreply.git.hamburg.ccc.de>	2025-10-25 17:37:10 +02:00
asohh	7ab17a1af5	added impressum as a var	2025-10-25 17:33:24 +02:00
asohh	c1c11dbabd	Merge pull request 'Minor updates to compose file' (#19) from docker-compose into main ... Reviewed-on: #19	2025-10-25 17:29:16 +02:00
ViMaSter	1d38aea2ca	chore: Removes unused SELinux flag due to volume usage	2025-10-25 17:28:11 +02:00
ViMaSter	67ebf21a09	chore: Removes unused build steps and exposed ports	2025-10-25 17:28:11 +02:00
asohh	9a141276ed	Merge pull request 'added impressum' (#16) from container into main ... Reviewed-on: #16	2025-10-25 17:18:04 +02:00
asohh	288b76d30e	Merge branch 'main' into container	2025-10-25 17:16:51 +02:00
asohh	969614a000	Merge pull request 'Removes unused files' (#15) from unused-file into main ... Reviewed-on: #15	2025-10-25 17:09:22 +02:00
asohh	c5cc45aa23	added impressum	2025-10-25 16:56:26 +02:00
ViMaSter	fb7db68946	Removes unused files	2025-10-25 16:52:46 +02:00
asohh	78cf0ea078	Merge pull request 'Containerizes application' (#12) from container into main ... Reviewed-on: #12	2025-10-25 16:40:44 +02:00
Vincent Mahnke	5ee9d6a288	Merge branch 'main' into container	2025-10-25 16:38:17 +02:00
asohh	641cb641ac	Merge pull request 'Resolve path issues in docs, removes dependency, moves database to volume' (#11) from docs into container ... Reviewed-on: #11	2025-10-25 16:29:27 +02:00
Vincent Mahnke	6289ed9f7e	fix: Replaces external project reference	2025-10-25 16:13:54 +02:00