dinawo
a8af857cd3
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is failing
security: fix vulnerabilities and harden code (2026-03-12)
Path traversal fixes:
- DeleteFile.js: use path.resolve() + symlink protection (CRITICAL)
- DeleteFileFolder.js: add path.resolve() validation + symlink check (CRITICAL)
- RenameFile.js: use path.resolve() with proper prefix check + symlink guard (HIGH)
- attachments.js: add baseDir validation + skip symlinks in recursive search (MEDIUM)
XSS fixes:
- dashboard.js: escape user input in onerror/onclick inline attributes (HIGH)
- paramadminsettingsetup.script.js: escape values in innerHTML template (MEDIUM)
Input validation:
- inputValidationMiddleware.js: block suspicious requests instead of logging only (MEDIUM)
Version bump: 1.2.2-beta → 1.2.3-beta
2026-03-12 20:18:28 +01:00
..
2026-03-12 17:16:16 +01:00
2025-06-14 22:01:39 +02:00
2026-03-12 20:18:28 +01:00
2026-03-12 20:18:28 +01:00
2026-03-12 17:16:16 +01:00
2024-05-28 20:20:52 +02:00
2024-06-02 18:13:28 +02:00
2024-06-02 18:13:28 +02:00
2024-06-02 18:13:28 +02:00
2025-06-14 22:01:39 +02:00
2026-03-12 17:16:16 +01:00
2026-03-12 17:16:16 +01:00
2026-03-12 20:18:28 +01:00
2025-06-14 22:01:39 +02:00
2025-06-14 22:01:39 +02:00
2025-10-25 23:55:51 +02:00
2024-12-21 18:16:25 +01:00
2024-10-27 16:48:30 +01:00
2026-03-12 17:16:16 +01:00
2025-06-14 22:01:39 +02:00