|
|
3bb3e80b77
|
security: lock down public S3 procedures and sanitize keys (p8-001, p8-008)
- Convert simpleDeleteImage, deleteImage, getPreSignedURL, listAttachments
from publicProcedure to csrfProtectedProcedure
- Add S3 type allowlist validation to prevent path traversal
- Sanitize title/filename inputs for S3 key construction
- Add ownership checks on delete operations
- Remove hashPassword/checkPassword procedures (bcrypt internals)
- Add regression tests for sanitization and validation
Fixes: p8-001 (anonymous S3 deletion), p8-008 (public presigned URL with unsanitized type)
|
2026-07-22 17:37:58 -04:00 |
|
|
|
d7c91ac6c5
|
rename
|
2026-01-24 19:31:14 -05:00 |
|
|
|
955c856a85
|
fix: analytics and deprecated warning
|
2026-01-21 13:58:34 -05:00 |
|
|
|
58d48dac70
|
checkpoint
|
2026-01-21 12:22:19 -05:00 |
|
|
|
5fc082178c
|
cairn work
|
2026-01-21 01:56:54 -05:00 |
|
|
|
f68f1f462a
|
session state simplification
|
2026-01-12 09:24:58 -05:00 |
|
|
|
9fc0a73fea
|
general: hot path cooldown
|
2026-01-11 14:24:28 -05:00 |
|
|
|
0a0c0e313e
|
migrated
|
2026-01-07 16:22:31 -05:00 |
|
|
|
ea556b3677
|
fledged out analytics, self gather, remove vercel speed insights
|
2026-01-06 01:34:55 -05:00 |
|
|
|
d2ee61b830
|
analytics page
|
2026-01-06 00:40:44 -05:00 |
|
|
|
7e89e6dda2
|
removed excess comments
|
2026-01-04 11:14:54 -05:00 |
|
|
|
8ca8e6f712
|
remove excess comments
|
2025-12-23 10:30:51 -05:00 |
|
|
|
79d2055159
|
okok
|
2025-12-19 17:15:05 -05:00 |
|
|
|
b3df3eedd2
|
continued migration
|
2025-12-16 23:31:12 -05:00 |
|
|
|
8fb748f401
|
init
|
2025-12-16 22:42:05 -05:00 |
|
