 Paul NothaftandPaul Nothaft
|
34a7b1c013
|
fix(security): block guest access to hidden/client-only photos across bulk + secure routes (stable) (#940)
* fix(security): block guest access to hidden/client-only photos across bulk + secure routes
* fix(security): harden hidden-photo fix per review (stale ZIP cache, legacy token mint, SQLite bool, client rebuild)
* fix(security): invalidate ZIP cache on photo visibility/category change (codex r2)
* fix(security): recheck photo visibility at signed/secure serve time (TOCTOU) + invalidate ZIP on client visibility change (codex r3)
---------
Co-authored-by: Paul Nothaft <[email protected]>
|
2026-08-01 17:36:46 +02:00 |
|