4 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Dinawo	a8af857cd3	security: fix vulnerabilities and harden code (2026-03-12) ... Path traversal fixes: - DeleteFile.js: use path.resolve() + symlink protection (CRITICAL) - DeleteFileFolder.js: add path.resolve() validation + symlink check (CRITICAL) - RenameFile.js: use path.resolve() with proper prefix check + symlink guard (HIGH) - attachments.js: add baseDir validation + skip symlinks in recursive search (MEDIUM) XSS fixes: - dashboard.js: escape user input in onerror/onclick inline attributes (HIGH) - paramadminsettingsetup.script.js: escape values in innerHTML template (MEDIUM) Input validation: - inputValidationMiddleware.js: block suspicious requests instead of logging only (MEDIUM) Version bump: 1.2.2-beta → 1.2.3-beta	2026-03-12 20:18:28 +01:00
Dinawo	76dc23c861	security: fix vulnerabilities and update security hardening (2026-03-12) ... Code security fixes: - Fixed 3 critical auth bypass bugs (user.jso, typo → user.json) in RenameFile, NewFolder, DeleteFolder API routes - Added URL validation (HTTP/HTTPS only) on ProfilPicture and BackgroundCustom endpoints to prevent stored XSS/CSS injection - Added path traversal protection in Upload.js (resolved path boundary check) - Removed unsafe-eval from CSP script-src directive - Removed information disclosure in BuildMetaData error responses - Removed unused child_process import in BuildMetaData.js Version bump: 1.2.1-beta → 1.2.2-beta	2026-03-12 17:16:16 +01:00
Dinawo	04a21927b2	Fix CORS blocking errors for CDN resources (v1.2.1-beta) ... Fixed ERR_BLOCKED_BY_RESPONSE.NotSameOrigin errors by implementing proper CORS headers for public resources: - Added Access-Control-Allow-Origin: * for public assets - Changed Cross-Origin-Resource-Policy to cross-origin for CDN files - Maintained strict security for sensitive routes - Added cache control for optimal CDN performance Affected files: - /public/* (images, CSS, JS, fonts) - /cdn-files/* (uploaded files) - /attachments (file serving)	2025-10-26 00:54:39 +02:00
Dinawo	2df1b28962	Update v1.2.0-beta - Dynamic context menu & permissions ... ✨ New Features: - Dynamic permission-based context menus for files and folders - Support for collaborative folder access control - Upload to specific folders including shared folders - Changelog modal for version updates - Improved dark mode synchronization 🐛 Bug Fixes: - Fixed context menu displaying incorrect options - Fixed CSS !important override preventing dynamic menu behavior - Fixed folder collaboration permission checks - Fixed breadcrumb navigation with empty segments - Fixed "Premature close" error loop in attachments - Fixed missing user variable in admin routes - Fixed avatar loading COEP policy issues 🔒 Security: - Added security middleware (CSRF, rate limiting, input validation) - Fixed collaboration folder access validation - Improved shared folder permission handling 🎨 UI/UX Improvements: - Removed Actions column from folder view - Context menu now properly hides/shows based on permissions - Better visual feedback for collaborative folders - Improved upload flow with inline modals 🧹 Code Quality: - Added collaboration data to folder routes - Refactored context menu logic for better maintainability - Added debug logging for troubleshooting - Improved file upload handling with chunking support	2025-10-25 23:55:51 +02:00