Claude
d46c0161fe
- Trust the Forge reverse proxy and force https URLs in production so generated absolute URLs match the actual TLS termination. - Reject Nostr profile photo URLs that aren't http(s) or that resolve to loopback / private (RFC1918) addresses to close an SSRF vector in FetchNostrProfileJob. - Tighten image upload validation across meetup, course, and lecturer create/edit components: explicit mimes whitelist (jpeg, png, webp), max 5 MiB, and dimension cap of 4000x4000. - Replace the silent "skip if exists" branch in LnurlAuthController with updateOrCreate so concurrent callers cannot race on the k1 record. - Validate github_data on Meetup edit, decoding the JSON, and keep only the whitelisted keys (top, left, state) with strict type coercion to prevent storing arbitrary attacker-controlled JSON.
Hosted:
- de-DE: https://portal.einundzwanzig.space/de/meetups
- de-AT: https://portal.einundzwanzig.space/at/meetups
- de-CH: https://portal.einundzwanzig.space/ch/meetups
- pl-PL: https://portal.dwadziesciajeden.pl/pl/meetups
- hu-HU: https://portal.huszonegy.world/hu/meetups
Host your national domain?
To add your national domain, you need to create a CNAME record pointing to portal.einundzwanzig.space.
Here's how:
- Add a subdomain like
portal.yourdomain.tld - Create a CNAME record pointing to
portal.einundzwanzig.space
DNS provider CNAME settings:
Type: CNAME
Name/Host/Alias: portal
Target/Value/Destination: portal.einundzwanzig.space
After setting up your CNAME, please notify the repository owner to refresh SSL certificates to include your domain.
Contributing and Proposals
Development
Prerequisites
- PHP 8.3+
- PostgreSQL (running locally or as a container)
- Redis (running locally or as a container)
- Node.js + Yarn
Installation
cp .env.example .env
composer install
(you need a valid Flux Pro license or send a message to Nostr - The Ben)
Migrate and seed the database
php artisan migrate:fresh --seed
Laravel storage link
php artisan storage:link
Install node dependencies
yarn
Start development environment
composer run dev
This starts the PHP dev server, queue worker, Pail log viewer, and Vite concurrently.
Update dependencies
yarn
Security Vulnerabilities
If you discover a security vulnerability within this project, please go to https://gitworkshop.dev. All security vulnerabilities will be promptly addressed.
License
Open-sourced software licensed under the MIT license.