 Paul Nothaft
|
8a87c9274b
|
fix(security): block guest access to hidden/client-only photos across bulk + secure routes (#939)
* fix(security): block guest access to hidden/client-only photos across bulk + secure routes
* fix(security): harden hidden-photo fix per review (stale ZIP cache, legacy token mint, SQLite bool, client rebuild)
* fix(security): invalidate ZIP cache on photo visibility/category change (codex r2)
* fix(security): recheck photo visibility at signed/secure serve time (TOCTOU) + invalidate ZIP on client visibility change (codex r3)
---------
Co-authored-by: Paul Nothaft <paul@MacStudio-von-Paul.local>
|
2026-08-01 17:36:15 +02:00 |
|