Trenton H d78754bff1 Security: validate remote OCR endpoint against internal SSRF (#13897) ...

* Security: validate remote OCR endpoint against internal SSRF

Adds PAPERLESS_REMOTE_OCR_ALLOW_INTERNAL_ENDPOINTS (default true)
and validates remote_ocr_endpoint via validate_outbound_http_url
on the config serializer, matching the existing LLM endpoint handling.

* Validates te outbound url again right before use

* cover empty-value branch of validate_remote_ocr_endpoint because coverage

* re-validate remote OCR endpoint on every outbound request

2026-09-01 20:22:10 +00:00

..

migrations

Allow parsers to declare uses remote, and remote ocr_mode (#13634)

2026-08-24 14:43:04 -07:00

parsers

Security: validate remote OCR endpoint against internal SSRF (#13897)

2026-09-01 20:22:10 +00:00

settings

Security: validate remote OCR endpoint against internal SSRF (#13897)

2026-09-01 20:22:10 +00:00

static/paperless/img

Enhancement: Paperless-ngx v3 Logo (#12673)

2026-04-29 16:38:25 -07:00

tests

Chore: consolidate pickle hmac signing (#13899)

2026-09-01 12:41:45 -07:00

__init__.py

Chore(deps-dev): Bump the development group with 4 updates (#8352)

2024-12-01 18:56:54 -08:00

adapter.py

Chore: fix session token strategy import deprecation (#11914)

2026-01-27 19:38:33 +00:00

admin.py

Change: restrict altering and creation of superusers to superusers only (#8837)

2025-01-20 11:57:22 -08:00

apps.py

Chore(mypy): Annotate None returns for typing improvements (#11213)

2026-02-02 08:44:12 -08:00

asgi.py

QoL: log version at startup, show backend vs frontend mismatch in system status (#10214)

2025-06-19 08:29:34 -07:00

auth.py

Fix: deny deactivated users in permission filtering and auto-login (#13623)

2026-08-10 02:25:06 +00:00

celery.py

Chore: consolidate pickle hmac signing (#13899)

2026-09-01 12:41:45 -07:00

checks.py

Enhancement: support using remote OCR engines selectively (#13633)

2026-08-24 14:17:52 -07:00

config.py

Allow parsers to declare uses remote, and remote ocr_mode (#13634)

2026-08-24 14:43:04 -07:00

consumers.py

Enhancement: websocket heartbeat (#13739)

2026-08-24 15:15:21 +00:00

db_cache.py

Chore(mypy): Annotate None returns for typing improvements (#11213)

2026-02-02 08:44:12 -08:00

filters.py

Fixes ruff not running isort against the codebase

2023-04-26 09:35:27 -07:00

logging.py

Feature: Update consumer logging to include task ID for log correlation (#12510)

2026-04-03 13:31:40 -07:00

middleware.py

Fixes ruff not running isort against the codebase

2023-04-26 09:35:27 -07:00

models.py

Allow parsers to declare uses remote, and remote ocr_mode (#13634)

2026-08-24 14:43:04 -07:00

network.py

Security: harden is_public_ip

2026-08-27 00:21:03 -07:00

serialisers.py

Security: validate remote OCR endpoint against internal SSRF (#13897)

2026-09-01 20:22:10 +00:00

signals.py

Fix: handle social account sync groups claim sent as str

2026-08-26 12:37:29 -07:00

signed_pickle.py

Chore: consolidate pickle hmac signing (#13899)

2026-09-01 12:41:45 -07:00

urls.py

Security: Minor additional hardening (#13898)

2026-09-01 19:53:28 +00:00

utils.py

Fix: include application config language settings for dateparser auto-detection (#10722)

2025-08-31 15:22:39 -07:00

validators.py

Enhancement: validate and sanitize uploaded logos (#12551)

2026-04-10 11:50:58 -07:00

version.py

Bump version to 3.1.2

2026-09-01 08:09:13 -07:00

views.py

Enhancement (beta): Switch the AI vector store to LanceDB (#12944)

2026-06-07 11:31:26 -07:00

wsgi.py

QoL: log version at startup, show backend vs frontend mismatch in system status (#10214)

2025-06-19 08:29:34 -07:00