dinawo a8af857cd3 security: fix vulnerabilities and harden code (2026-03-12) ...

Path traversal fixes:
- DeleteFile.js: use path.resolve() + symlink protection (CRITICAL)
- DeleteFileFolder.js: add path.resolve() validation + symlink check (CRITICAL)
- RenameFile.js: use path.resolve() with proper prefix check + symlink guard (HIGH)
- attachments.js: add baseDir validation + skip symlinks in recursive search (MEDIUM)

XSS fixes:
- dashboard.js: escape user input in onerror/onclick inline attributes (HIGH)
- paramadminsettingsetup.script.js: escape values in innerHTML template (MEDIUM)

Input validation:
- inputValidationMiddleware.js: block suspicious requests instead of logging only (MEDIUM)

Version bump: 1.2.2-beta → 1.2.3-beta

2026-03-12 20:18:28 +01:00

..

assets

Update v1.1.1-beta1

2025-06-14 22:01:39 +02:00

css

Update v1.2.0-beta - Dynamic context menu & permissions

2025-10-25 23:55:51 +02:00

js

security: fix vulnerabilities and harden code (2026-03-12)

2026-03-12 20:18:28 +01:00