bruno 69a0aceba6 fix: A10 — autoescape Jinja2 activé partout via un Environment partagé ...

- `app/templating.py` : `ENV = Environment(loader=FileSystemLoader("app/templates"), autoescape=select_autoescape(["html"]))`
- les 29 instantiations `Environment(loader=FileSystemLoader("app/templates"))` (9 routers) remplacées par `env = ENV` — plus aucune interpolation `{{ … }}` servie crue, les `|safe` redeviennent efficaces
- re-tri des `|safe` : `card_detail.html` corps d'issue et commentaires échappés (XSS stocké), placeholder de description sorti du ternaire, `sidebar_config` passé en dict + `|tojson` (échappement `</script>` en contexte script)
- `|safe` conservé sur `right_actions` (HTML fabriqué dans les templates, fiable)
- `ruff check app tests` OK · suite **1016/1016 verts**

2026-09-30 22:28:48 -04:00

..

__init__.py

feat: FlowDeck v0.2.0 — Kanban Gitea intégré

2026-07-08 08:41:31 -04:00

admin.py

v5.2.0: Infrastructure & Polish

2026-09-10 23:47:35 -04:00

agent.py

feat: v6.6.0 — Agent phase 5 : API publique agent (/api/v2/agents, run synchrone JSON) + marketplace skills (export/import portable + galerie de 6 presets, palette / du panneau) + webhooks agent.run.started/failed · 764 tests verts

2026-09-24 10:16:24 -04:00

api_v2_agent.py

feat: v6.6.0 — Agent phase 5 : API publique agent (/api/v2/agents, run synchrone JSON) + marketplace skills (export/import portable + galerie de 6 presets, palette / du panneau) + webhooks agent.run.started/failed · 764 tests verts

2026-09-24 10:16:24 -04:00

api_v2.py

feat: v6.5.0 Synced blocks production — pages contenu par lignes de DB, résolution serveur à chaque lecture, propagation écrite réelle

2026-09-24 08:28:25 -04:00

api.py

fix: A10 — autoescape Jinja2 activé partout via un Environment partagé

2026-09-30 22:28:48 -04:00

audit.py

feat: v7.3.0 — cycle v6.8.0→v7.3.0 (Sites, Search, Automations, Calendar, SCIM, Wiki) + audit A9

2026-09-30 20:02:57 -04:00

auth.py

feat: v7.3.0 — cycle v6.8.0→v7.3.0 (Sites, Search, Automations, Calendar, SCIM, Wiki) + audit A9

2026-09-30 20:02:57 -04:00

automations.py

feat: v7.3.0 — cycle v6.8.0→v7.3.0 (Sites, Search, Automations, Calendar, SCIM, Wiki) + audit A9

2026-09-30 20:02:57 -04:00

board.py

fix: A10 — autoescape Jinja2 activé partout via un Environment partagé

2026-09-30 22:28:48 -04:00

collaboration.py

feat: v7.3.0 — cycle v6.8.0→v7.3.0 (Sites, Search, Automations, Calendar, SCIM, Wiki) + audit A9

2026-09-30 20:02:57 -04:00

collections.py

fix: A3–A8 — bloc « fallback admin » de l'audit sécurité (401 sans session, ACL, CSRF)

2026-09-30 22:04:13 -04:00

dashboard.py

fix: A10 — autoescape Jinja2 activé partout via un Environment partagé

2026-09-30 22:28:48 -04:00

emoji.py

feat(icon): Notion-style icon picker + custom workspace emojis; fix side peek file content & ctx menu overflow

2026-09-12 20:05:53 -04:00

export.py

feat(v5.2.0): finalize Infrastructure & Polish (tests isolation, xdist, lint, CI)

2026-09-11 23:36:53 -04:00

gitea.py

feat(v5.2.0): finalize Infrastructure & Polish (tests isolation, xdist, lint, CI)

2026-09-11 23:36:53 -04:00

github_routes.py

fix: github_routes use access_token (not github_token)

2026-07-14 12:21:10 -04:00

governance.py

feat: v7.3.0 — cycle v6.8.0→v7.3.0 (Sites, Search, Automations, Calendar, SCIM, Wiki) + audit A9

2026-09-30 20:02:57 -04:00

imports.py

fix: A10 — autoescape Jinja2 activé partout via un Environment partagé

2026-09-30 22:28:48 -04:00

library.py

feat(share,permissions): partage de page par groupes (page_shares)

2026-09-21 06:38:02 -04:00

meetings.py

feat: v7.3.0 — cycle v6.8.0→v7.3.0 (Sites, Search, Automations, Calendar, SCIM, Wiki) + audit A9

2026-09-30 20:02:57 -04:00

my_tasks.py

fix: A10 — autoescape Jinja2 activé partout via un Environment partagé

2026-09-30 22:28:48 -04:00

notes.py

fix: A10 — autoescape Jinja2 activé partout via un Environment partagé

2026-09-30 22:28:48 -04:00

notifications.py

feat(calendar): v5.8.0 calendrier & rappels + v5.7.0 database avancee (pt.2)

2026-09-13 22:49:14 -04:00

onboarding.py

fix: A10 — autoescape Jinja2 activé partout via un Environment partagé

2026-09-30 22:28:48 -04:00

permissions.py

feat: v6.1.0 granular permissions (page/collection/property ACL + groups + audit)

2026-09-19 22:54:16 -04:00

projects.py

v5.2.0: Infrastructure & Polish

2026-09-10 23:47:35 -04:00

public_api.py

fix: A3–A8 — bloc « fallback admin » de l'audit sécurité (401 sans session, ACL, CSRF)

2026-09-30 22:04:13 -04:00

realtime.py

feat: v6.4.0 Realtime production — merge 3-voix (au-delà du LWW) + broadcast non bloquant

2026-09-23 23:55:39 -04:00

scim.py

feat: v7.3.0 — cycle v6.8.0→v7.3.0 (Sites, Search, Automations, Calendar, SCIM, Wiki) + audit A9

2026-09-30 20:02:57 -04:00

search_ai.py

feat: v7.3.0 — cycle v6.8.0→v7.3.0 (Sites, Search, Automations, Calendar, SCIM, Wiki) + audit A9

2026-09-30 20:02:57 -04:00

search.py

v5.2.0: Infrastructure & Polish

2026-09-10 23:47:35 -04:00

security.py

v5.2.0: Infrastructure & Polish

2026-09-10 23:47:35 -04:00

sharing.py

Fire automation events across API routers

2026-09-21 20:30:05 -04:00

sidebar_config.py

feat: v7.3.0 — cycle v6.8.0→v7.3.0 (Sites, Search, Automations, Calendar, SCIM, Wiki) + audit A9

2026-09-30 20:02:57 -04:00

sites.py

feat: v7.3.0 — cycle v6.8.0→v7.3.0 (Sites, Search, Automations, Calendar, SCIM, Wiki) + audit A9

2026-09-30 20:02:57 -04:00

sso.py

feat: v6.7.0 — SSO/SAML + OIDC entreprise (SP SAML signé + OIDC PKCE, auto-provisioning, groupes IdP → rôles workspace, SSO only, onglet Settings « SSO / Enterprise », API /api/v2/sso/*, help, migration 23, docs + OpenAPI 439 chemins) · 802 tests verts

2026-09-24 13:32:17 -04:00

sync.py

chore: fix ruff lint (webhooks v2) + Windows-safe test teardown

2026-09-21 21:58:47 -04:00

web_clipper.py

fix: A10 — autoescape Jinja2 activé partout via un Environment partagé

2026-09-30 22:28:48 -04:00

webauthn.py

feat: v7.3.0 — cycle v6.8.0→v7.3.0 (Sites, Search, Automations, Calendar, SCIM, Wiki) + audit A9

2026-09-30 20:02:57 -04:00

webhooks.py

feat(v5.2.0): finalize Infrastructure & Polish (tests isolation, xdist, lint, CI)

2026-09-11 23:36:53 -04:00

wiki.py

fix: A10 — autoescape Jinja2 activé partout via un Environment partagé

2026-09-30 22:28:48 -04:00

workers.py

feat: v7.3.0 — cycle v6.8.0→v7.3.0 (Sites, Search, Automations, Calendar, SCIM, Wiki) + audit A9

2026-09-30 20:02:57 -04:00

workspace.py

fix: A3–A8 — bloc « fallback admin » de l'audit sécurité (401 sans session, ACL, CSRF)

2026-09-30 22:04:13 -04:00