Maurice bd5a6cc748 fix(cors): the instance's own address no longer trips ALLOWED_ORIGINS ...

With ALLOWED_ORIGINS set, every request carrying an Origin that was not on
the list was failed with an unhandled error, which the exception filter
answered with a 500. A browser sends Origin on every POST and WebSocket
upgrade, including same-origin ones, so opening TREK under any address the
list did not name (the LAN IP, a second hostname, http instead of https)
broke the login with "Internal Server Error" while another browser that
used the listed address worked.

A request whose Origin is the host it was sent to is now treated as
same-origin and always passes, for REST and the /ws upgrade alike. A
foreign origin is still refused, now with a 403 "Not allowed by CORS" and a
warning in the log naming the origin to add.

Closes #2543

2026-09-29 21:16:26 +02:00

..

assets

feat(trips): Share and Save to list in the new dialog look

2026-09-28 13:19:04 +02:00

_Footer.md

v3.4.0 (#1540)

2026-07-18 22:13:52 +02:00

_Sidebar.md

docs(wiki): a page for the help center

2026-09-24 14:05:42 +02:00

Accommodations.md

feat(costs): table view, and the wiki and help center for the new trip page

2026-09-27 23:15:19 +02:00

Addons-Overview.md

docs(wiki): bring the pages in line with 4.3.0

2026-09-20 12:11:41 +02:00

Admin-Addons.md

fix(llm-parse): harden photo reading and finish the receipt scan

2026-09-26 15:59:05 +02:00

Admin-Categories.md

docs(wiki): bring the wiki in line with 4.0.0 (#2034)

2026-08-25 12:36:52 +02:00

Admin-GitHub-Releases.md

docs(wiki): bring the pages in line with 4.3.0

2026-09-20 12:11:41 +02:00

Admin-MCP-Tokens.md

docs(wiki): correct what reading each page whole turned up (#2036)

2026-08-25 15:22:46 +02:00

Admin-Packing-Templates.md

v3.4.0 (#1540)

2026-07-18 22:13:52 +02:00

Admin-Panel-Overview.md

feat(notifications): Web Push delivers notifications to every device, even with TREK closed

2026-09-24 23:17:03 +00:00

Admin-Permissions.md

Require share_manage for the two public credentials (#1883)

2026-08-11 11:15:32 +02:00

Admin-Plugins.md

feat(plugins): plugins can add POI categories to the map and answer them

2026-09-25 01:24:55 +00:00

Admin-Storage.md

docs(wiki): document road trip, document sync, the TREK Places API and Dawarich

2026-09-19 21:45:16 +02:00

Admin-Users-and-Invites.md

docs(wiki): correct what reading each page whole turned up (#2036)

2026-08-25 15:22:46 +02:00

AI-Booking-Import.md

feat(costs): table view, and the wiki and help center for the new trip page

2026-09-27 23:15:19 +02:00

Appearance-Settings.md

docs(wiki): bring the wiki in line with 4.0.0 (#2034)

2026-08-25 12:36:52 +02:00

Atlas.md

docs(wiki): bring the pages in line with 4.3.0

2026-09-20 12:11:41 +02:00

Audit-Log.md

docs(wiki): the pages the 4.3.1 changes left behind

2026-09-22 13:30:12 +02:00

Backups.md

docs(wiki): bring the wiki in line with 4.0.0 (#2034)

2026-08-25 12:36:52 +02:00

Budget-Tracking.md

feat(costs): table view, and the wiki and help center for the new trip page

2026-09-27 23:15:19 +02:00

Calendar-Feeds.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00

Collab-Chat.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00

Collab-Notes.md

feat(costs): table view, and the wiki and help center for the new trip page

2026-09-27 23:15:19 +02:00

Collab-Polls.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00

Collections.md

feat(trips): Share and Save to list in the new dialog look

2026-09-28 13:19:04 +02:00

Contributing.md

docs: TREK ships 27 languages now

2026-09-24 17:35:25 +02:00

Creating-a-Trip.md

docs(wiki): deleting and adding days, and what shortening a trip removes

2026-09-23 22:40:46 +02:00

Currencies.md

fix(trips): a trip created without a currency takes the display currency

2026-09-22 11:06:13 +02:00

Dashboard-Widgets.md

docs(wiki): correct what reading each page whole turned up (#2036)

2026-08-25 15:22:46 +02:00

Dawarich.md

docs(wiki): document road trip, document sync, the TREK Places API and Dawarich

2026-09-19 21:45:16 +02:00

Day-Plans-and-Notes.md

fix(planner): the plan's costs follow the expenses in Costs

2026-09-29 21:16:25 +02:00

Demo-Mode.md

docs(wiki): bring the wiki in line with 4.0.0 (#2034)

2026-08-25 12:36:52 +02:00

Development-environment.md

docs(wiki): name the toolchain npm asks for on install since better-sqlite3 13

2026-09-21 11:09:38 +02:00

Display-Settings.md

feat(plugins): plugins can add POI categories to the map and answer them

2026-09-25 01:24:55 +00:00

Document-Sync.md

fix: the findings of the final 4.3.0 audit

2026-09-20 13:54:31 +02:00

Documents-and-Files.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00

Encryption-Key-Rotation.md

feat(notifications): Web Push delivers notifications to every device, even with TREK closed

2026-09-24 23:17:03 +00:00

Environment-Variables.md

feat(notifications): Web Push delivers notifications to every device, even with TREK closed

2026-09-24 23:17:03 +00:00

FAQ.md

docs(wiki): document road trip, document sync, the TREK Places API and Dawarich

2026-09-19 21:45:16 +02:00

Help-Center.md

docs(wiki): a page for the help center

2026-09-24 14:05:42 +02:00

Home.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00

In-App-Help.md

docs(wiki): a page for the help center

2026-09-24 14:05:42 +02:00

Install-Docker-Compose.md

docs(wiki): correct what reading each page whole turned up (#2036)

2026-08-25 15:22:46 +02:00

Install-Docker.md

docs(wiki): bring the pages in line with 4.3.0

2026-09-20 12:11:41 +02:00

Install-Helm.md

feat(notifications): Web Push delivers notifications to every device, even with TREK closed

2026-09-24 23:17:03 +00:00

Install-Portainer.md

fix(docker): move start-up into a script so an edited container still boots

2026-09-20 12:48:44 +02:00

Install-Proxmox.md

docs(wiki): correct what reading each page whole turned up (#2036)

2026-08-25 15:22:46 +02:00

Install-Unraid.md

feat(notifications): Web Push delivers notifications to every device, even with TREK closed

2026-09-24 23:17:03 +00:00

Internal-Network-Access.md

fix(ssrf): connect past a link-local DNS record instead of refusing the host (#2506)

2026-09-26 10:36:02 +02:00

Invite-Links.md

docs(wiki): correct what reading each page whole turned up (#2036)

2026-08-25 15:22:46 +02:00

Journey-Journal.md

fix(journey): select all takes every photo in the range and imports keep their order

2026-09-24 23:48:49 +00:00

Languages.md

docs: TREK ships 27 languages now

2026-09-24 17:35:25 +02:00

Login-and-Registration.md

feat(login): an OIDC-only instance shows the way to the IdP, not a form

2026-09-24 16:34:51 +02:00

Map-Features.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00

Map-Settings.md

docs(wiki): bring the pages in line with 4.3.0

2026-09-20 12:11:41 +02:00

MCP-Addon-Tools.md

revert(collections): a saved place carries no price, website or phone again

2026-09-23 20:32:41 +02:00

MCP-Overview.md

docs(wiki): bring the wiki in line with 4.0.0 (#2034)

2026-08-25 12:36:52 +02:00

MCP-Prompts.md

docs: add full wiki with 74 pages, assets, and CI workflow

2026-04-20 10:11:53 +02:00

MCP-Scopes.md

Merge branch 'main' into dev

2026-09-20 15:29:35 +02:00

MCP-Setup.md

docs(wiki): the Open WebUI callback carries mcp: in front of the connection ID

2026-09-23 08:28:29 +02:00

MCP-Tools-and-Resources.md

fix(costs): leave out an expense no rate is known for instead of counting it 1:1

2026-09-26 13:19:27 +02:00

My-Trips-Dashboard.md

docs(wiki): correct what reading each page whole turned up (#2036)

2026-08-25 15:22:46 +02:00

Notifications.md

feat(notifications): Web Push delivers notifications to every device, even with TREK closed

2026-09-24 23:17:03 +00:00

Offline-Mode-and-PWA.md

feat(notifications): Web Push delivers notifications to every device, even with TREK closed

2026-09-24 23:17:03 +00:00

OIDC-SSO.md

fix(oidc): never take a role away over a claim the provider did not send

2026-09-20 12:48:44 +02:00

Packing-Lists.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00

Packing-Templates.md

docs(wiki): correct what reading each page whole turned up (#2036)

2026-08-25 15:22:46 +02:00

Passkeys.md

docs(wiki): bring the wiki in line with 4.0.0 (#2034)

2026-08-25 12:36:52 +02:00

Password-Reset.md

docs(wiki): correct what reading each page whole turned up (#2036)

2026-08-25 15:22:46 +02:00

PDF-Export.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00

Photo-Providers.md

fix: follow-ups from the review of the price, Immich, moving day and import fixes

2026-09-23 17:41:26 +02:00

Places-and-Search.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00

Plugin-Cookbook.md

feat(plugins): search plugins can answer the place search as you type

2026-09-25 09:19:11 +02:00

Plugin-Development.md

feat(plugins): search plugins can answer the place search as you type

2026-09-25 09:19:11 +02:00

Plugin-Permissions.md

feat(plugins): search plugins can answer the place search as you type

2026-09-25 09:19:11 +02:00

Plugin-Publishing.md

docs(wiki): bring the pages in line with 4.3.0

2026-09-20 12:11:41 +02:00

Plugins.md

feat(plugins): plugins can add POI categories to the map and answer them

2026-09-25 01:24:55 +00:00

Public-API.md

docs(wiki): deleting and adding days, and what shortening a trip removes

2026-09-23 22:40:46 +02:00

Public-Share-Links.md

feat(share): the public trip page in the planner's design

2026-09-28 14:40:34 +02:00

Quick-Start.md

docs(wiki): bring the wiki in line with 4.0.0 (#2034)

2026-08-25 12:36:52 +02:00

Real-Time-Collaboration.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00

Reservations-and-Bookings.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00

Reverse-Proxy.md

docs(wiki): correct what reading each page whole turned up (#2036)

2026-08-25 15:22:46 +02:00

Road-Trip.md

fix(roadtrip): a booked night no longer shows up mid-day when the day already ends at the stay

2026-09-29 21:16:26 +02:00

Route-Optimization.md

feat(costs): table view, and the wiki and help center for the new trip page

2026-09-27 23:15:19 +02:00

Security-Hardening.md

docs(wiki): bring the pages in line with 4.3.0

2026-09-20 12:11:41 +02:00

Tags-and-Categories.md

docs(wiki): correct what reading each page whole turned up (#2036)

2026-08-25 15:22:46 +02:00

Todos-and-Tasks.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00

Transport-Flights-Trains-Cars.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00

TREK-Places-API.md

docs(wiki): the pages the 4.3.1 changes left behind

2026-09-22 13:30:12 +02:00

Trip-Members-and-Sharing.md

feat(trips): Share and Save to list in the new dialog look

2026-09-28 13:19:04 +02:00

Trip-Planner-Overview.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00

Troubleshooting.md

fix(cors): the instance's own address no longer trips ALLOWED_ORIGINS

2026-09-29 21:16:26 +02:00

Two-Factor-Authentication.md

docs(wiki): bring the pages in line with 4.3.0

2026-09-20 12:11:41 +02:00

Updating.md

docs(wiki): the pages the 4.3.1 changes left behind

2026-09-22 13:30:12 +02:00

User-Settings.md

fix(llm-parse): harden photo reading and finish the receipt scan

2026-09-26 15:59:05 +02:00

Vacay.md

feat(settings): every date picker starts its week on the day you pick

2026-09-24 21:56:12 +02:00

Weather-Forecasts.md

feat(costs): table view, and the wiki and help center for the new trip page

2026-09-27 23:15:19 +02:00

Whats-Next-Widget.md

docs(wiki): the pictures that were missing, and the follow-ups of the rewrite

2026-09-28 12:19:49 +02:00