fix(security): KB fileUrl LFI, MCP/Agiloft SSRF pinning, form OTP, KB authz#4639

Merged

waleedlatif1 merged 6 commits into

waleedlatif1/fix-kb-fileurl-lfi

May 17, 2026

Commits on May 17, 2026

fix(security): KB fileUrl LFI, MCP/Agiloft SSRF pinning, form OTP, KB authz
waleedlatif1
committed
fix(otp): don't leak caught error.message; fail-closed on DB retry exhaust

waleedlatif1
and
claude
committed
fix(mcp): use undici fetch directly in pinned-fetch for typed dispatcher

waleedlatif1
and
claude
committed
fix(build): keep agiloft/grafana tool configs client-safe

waleedlatif1
and
claude
committed
fix(knowledge): case-insensitive scheme checks for fileUrl

waleedlatif1
and
claude
committed
fix(mcp): annotate undici/DOM type-bridge double-casts in pinned-fetch

waleedlatif1
and
claude
committed