b54a80d251
feat: add Dutch (nl) locale and fix missing translation keys across all locales
...
Add complete Dutch translation (2054 keys) with Netherlands flag in the
language selector. Also synchronize all existing locales so every language
has the same set of keys: added 29 missing keys to EN/RU/PT and 95 missing
keys to DE (moderation, analytics, CSS templates, backup, events).
2026-03-25 22:35:57 +01:00
2ac6c51fe5
chore(beta): release 3.21.1-beta.0 ( #255 )
...
Build and Push Docker Images / build-backend (push) Failing after 3m42s
Build and Push Docker Images / build-frontend (push) Failing after 3m41s
Build and Push Docker Images / summary (push) Successful in 3s
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-03-22 12:43:55 +01:00
23cd9cb680
fix: address Shannon security assessment findings (37 vulnerabilities) ( #254 )
...
Remediate 4 Critical, 18 High, 10 Medium, and 5 Low vulnerabilities
identified in the Shannon security assessment (2026-03-20).
Critical fixes:
- Command injection via rsync SSH key path (INJ-VULN-01)
- Self-escalation to super_admin role (AUTHZ-VULN-11)
- Invite super_admin backdoor (AUTHZ-VULN-12)
- Handlebars SSTI in email templates (INJ-VULN-05)
Authentication hardening:
- Rate limit on share-link login (AUTH-VULN-01)
- X-Forwarded-For spoofing bypass (AUTH-VULN-02)
- reCAPTCHA fails closed when misconfigured (AUTH-VULN-03)
- Token revocation on admin/gallery logout (AUTH-VULN-04/05)
- Cookie Secure flag defaults true in production (AUTH-VULN-06)
- Remove JWT from admin login response body (AUTH-VULN-07)
- Timing-safe gallery slug validation (AUTH-VULN-09)
- Account lockout fails closed on DB error (AUTH-VULN-12)
- Session endpoint checks token revocation
Path traversal & file access:
- checksums endpoint path containment (INJ-VULN-03)
- manifest validate path containment (INJ-VULN-04)
XSS prevention:
- Block SVG data URIs in CSS sanitizer (XSS-VULN-01)
- Email preview iframe sandbox (XSS-VULN-02)
- SSR branding HTML escaping (XSS-VULN-03)
- User-Agent sanitization in feedback (XSS-VULN-04)
Authorization (IDOR):
- Event ownership middleware for all admin routes
- Cross-admin user profile read restriction (AUTHZ-VULN-10)
SSRF & infrastructure:
- Private IP validation for SMTP, S3, rsync hosts
- Replace inline JWT with standard adminAuth middleware
- CSRF Content-Type enforcement on mutating API endpoints
- CSP headers in nginx location blocks
Token revocation fix:
- Remove overly broad orWhere clause that invalidated all future tokens
- Allow empty-body POST requests (logout) in CSRF middleware
Co-authored-by: Paul Nothaft <paul@MacStudio-von-Paul.local >
2026-03-22 12:40:01 +01:00
a63f1a8dd9
chore(beta): release 3.21.0-beta.0 ( #253 )
...
Build and Push Docker Images / build-backend (push) Failing after 3m46s
Build and Push Docker Images / build-frontend (push) Failing after 3m47s
Build and Push Docker Images / summary (push) Successful in 2s
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-03-18 10:59:14 +01:00
954a0118ba
fix: wrap test email with standard email template ( #252 )
...
Use wrapEmailHtml() for the test email so it matches the look of all
other emails sent by the platform (logo, footer, etc.).
Co-authored-by: Paul Nothaft <paul@MacStudio-von-Paul.local >
2026-03-18 10:49:45 +01:00
ee46088985
feat: add per-gallery thumbnail scale setting ( #172 ) ( #251 )
...
Add a thumbnailScale field (xs/sm/md/lg/xl) to gallery layout settings
that adjusts column counts for Grid, Masonry (columns mode), and Mosaic
layouts. Each scale maps to a column offset applied on top of the
layout's base columns, letting photographers control photo density.
- Add thumbnailScale to GalleryLayoutSettings type
- Apply scale offset in Grid, Masonry, and Mosaic layout components
- Add thumbnail scale dropdown to admin theme customizer
- Conditionally show dropdown only for applicable layouts
- Safelist dynamic grid-cols classes in Tailwind config
- Add i18n keys for EN, DE, PT, RU locales
Co-authored-by: Paul Nothaft <paul@MacStudio-von-Paul.local >
2026-03-18 10:44:07 +01:00
3742d71535
chore(beta): release 3.20.1-beta.0 ( #250 )
...
Build and Push Docker Images / build-backend (push) Failing after 3m46s
Build and Push Docker Images / build-frontend (push) Failing after 3m46s
Build and Push Docker Images / summary (push) Successful in 3s
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-03-17 17:18:56 +01:00
486239aeb9
fix: address beta feedback - gallery layout fixes, Russian locale, email logo ( #249 )
...
- Add Russian (Русский) to admin settings language dropdown
- Fix Premium layout hero using thumbnail instead of hero_url
- Hide "Uncategorized" section header in Story layout for uncategorized photos
- Add PhotoLightbox to Story layout so photo clicks open full-screen view
- Use full-res images in StoryPhotoCard instead of thumbnails
- Defer public gallery auto-login text until settings/locale are loaded
- Add validation and debug logging for email logo URL construction
Co-authored-by: Paul Nothaft <paul@MacStudio-von-Paul.local >
2026-03-17 17:16:50 +01:00
2c5ae6fbb9
Merge pull request #248 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (push) Failing after 3m22s
Build and Push Docker Images / build-frontend (push) Failing after 3m22s
Build and Push Docker Images / summary (push) Successful in 3s
chore(beta): release 3.20.0-beta.0
2026-03-17 13:14:43 +01:00
f9889a93fb
chore(beta): release 3.20.0-beta.0
2026-03-17 12:05:29 +00:00
4a93e4e8cb
Merge pull request #247 from the-luap/feat/photo-visibility-client-access
...
feat: photo visibility control with client access (#172 )
2026-03-17 13:05:12 +01:00
e1b6e43e52
feat: photo visibility control with client access ( #172 )
...
Add two-tier gallery access system allowing clients (e.g., wedding couples) to
review and hide photos before the gallery is shared with guests.
Backend:
- Migration 074: add visibility column to photos, client_access_enabled/
client_password_hash/client_share_token to events
- Client login endpoint (POST /auth/gallery/:slug/client-login) with bcrypt PIN
- Gallery photo list filters hidden photos for guests, shows all for clients
- Visibility toggle endpoints (single + bulk) for client access level
- Admin event CRUD supports client access fields
- Email template includes client access link + PIN (EN/DE/RU/PT)
Frontend:
- ClientAccessPage: PIN entry form at /gallery/:slug/client-access
- GalleryView: client mode banner, visibility counter, toggle controls
- GridGalleryLayout: eye/eye-off overlay per photo for clients
- AdminPhotoGrid: visibility badge, bulk Hide/Show buttons
- EventDetailsPage: Client Access settings section (toggle, PIN, link)
- CreateEventPage: client access toggle + PIN in event creation form
- GalleryAuthContext: accessLevel/isClient/clientLogin support
- New complete pt-BR locale (pt.json) with all translations
- Client access i18n keys for EN, DE, RU, PT
2026-03-17 13:04:41 +01:00
999c66dbbf
Merge pull request #244 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (push) Failing after 3m24s
Build and Push Docker Images / build-frontend (push) Failing after 3m24s
Build and Push Docker Images / summary (push) Successful in 2s
chore(beta): release 3.19.2-beta.0
2026-03-16 22:37:45 +01:00
f5997892c4
chore(beta): release 3.19.2-beta.0
2026-03-16 21:35:09 +00:00
7ca96315e2
Merge pull request #243 from the-luap/fix/security-session-invalidation
...
fix(security): token invalidation on password change, session timeout enforcement
2026-03-16 22:34:53 +01:00
f3622396e7
fix(security): invalidate tokens on password change, enforce session timeout, fix role update
...
- Set password_changed_at when changing password via adminAuth route so
existing JWT tokens are rejected by the auth middleware check
- Enforce session timeout on first request with unseen tokens by checking
token iat against configured timeout (prevents bypass after server restart)
- Convert camelCase roleId/isActive to snake_case role_id/is_active in
frontend updateUser service (fixes silent role update failures)
Resolves GHSA-rqg3-47p5-vgwg
2026-03-16 22:34:32 +01:00
56cf60c570
Merge pull request #242 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-frontend (push) Failing after 3m26s
Build and Push Docker Images / build-backend (push) Failing after 3m26s
Build and Push Docker Images / summary (push) Successful in 3s
chore(beta): release 3.19.1-beta.0
2026-03-16 22:32:17 +01:00
2618415aa1
chore(beta): release 3.19.1-beta.0
2026-03-16 21:23:14 +00:00
dfae2c2bc6
Merge pull request #241 from the-luap/fix/external-media-dimensions-and-email-colors
...
fix: external media dimensions, theme race condition, email color customization
2026-03-16 22:22:58 +01:00
bbeedd1888
fix: resolve external media dimensions, gallery theme race condition, and add email color customization
...
- Fix dimension repair for external media by using photoResolver instead of hardcoded paths
- Extract photo dimensions via Sharp during external media import
- Remove duplicate theme useEffect from GalleryView to prevent flash/revert race condition
- Pass event welcome_message to Story layout footer for per-event customization
- Add email_primary_color/email_secondary_color settings with admin UI color pickers
- Add i18n keys for email branding in all 4 locales (en, de, ru, pt)
2026-03-16 22:22:36 +01:00
201965b4b1
Merge pull request #240 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (push) Failing after 3m29s
Build and Push Docker Images / build-frontend (push) Failing after 3m29s
Build and Push Docker Images / summary (push) Successful in 2s
chore(beta): release 3.19.0-beta.0
2026-03-16 20:25:20 +01:00
1468c459ba
chore(beta): release 3.19.0-beta.0
2026-03-16 16:24:01 +00:00
088de43f09
Merge pull request #239 from the-luap/feat/photo-cap-and-portuguese-locale
...
feat: add photo cap per event and Portuguese locale
2026-03-16 17:23:37 +01:00
1fa222e9c4
feat: add photo cap per event and Portuguese (pt-BR) locale
...
- Add photo_cap column to events table (migration 074) to limit photos per event
- Enforce photo cap in upload route, returning 400 when limit exceeded
- Pass photo_cap through all event CRUD routes and frontend forms
- Add complete Portuguese (pt-BR) translation (2300+ strings)
- Register pt locale in i18n config, language selector, date formatting
- Add photoCap/photoCapHelp translation keys to all locale files (en, de, ru, pt)
2026-03-16 17:22:54 +01:00
6aceb40595
Merge pull request #238 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-frontend (push) Failing after 3m20s
Build and Push Docker Images / build-backend (push) Failing after 3m23s
Build and Push Docker Images / summary (push) Successful in 2s
chore(beta): release 3.18.2-beta.0
2026-03-16 16:26:55 +01:00
431a82eca1
chore(beta): release 3.18.2-beta.0
2026-03-16 15:26:11 +00:00
85a07fcca7
Merge pull request #237 from the-luap/fix/security-dep-updates
...
fix: resolve code scanning security alerts (multer, tar, Node 22)
2026-03-16 16:25:52 +01:00
1f524f2358
fix: update dependencies to resolve code scanning security alerts
...
- Upgrade multer to 2.1.1 (CVE-2026-3520, DoS via malformed requests)
- Update tar override to >=7.5.11 (CVE-2026-31802, CVE-2026-29786)
- Upgrade Node base image from 20-alpine to 22-alpine to fix npm
bundled tar/minimatch CVEs in the Docker image
2026-03-16 16:25:29 +01:00
48a025b915
Merge pull request #236 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-frontend (push) Failing after 3m20s
Build and Push Docker Images / build-backend (push) Failing after 3m25s
Build and Push Docker Images / summary (push) Successful in 3s
chore(beta): release 3.18.1-beta.0
2026-03-16 15:02:04 +01:00
c652ae0ead
chore(beta): release 3.18.1-beta.0
2026-03-16 14:01:13 +00:00
9a6d2e8e3a
Merge pull request #235 from the-luap/fix/email-preview-wrapper
...
fix: wrap email preview with full styled header/footer template
2026-03-16 15:00:56 +01:00
fc0911acf8
fix: wrap email preview with full styled header/footer template
...
The email template preview modal was showing only raw body HTML without
the styled wrapper (green header bar, logo, footer with company name)
that processTemplate() applies when sending. This made preview not match
what recipients actually receive.
Extract wrapEmailHtml() from processTemplate() and reuse it in the
preview endpoint. Also fix logo URL to use FRONTEND_URL consistently.
Closes #229
2026-03-16 15:00:37 +01:00
f77802325a
Merge pull request #234 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (push) Failing after 3m37s
Build and Push Docker Images / build-frontend (push) Failing after 3m37s
Build and Push Docker Images / summary (push) Successful in 2s
chore(beta): release 3.18.0-beta.0
2026-03-16 10:22:14 +01:00
74c9a5fbcd
chore(beta): release 3.18.0-beta.0
2026-03-16 08:38:17 +00:00
703c03fbee
Merge pull request #233 from the-luap/feat/visual-email-editor
...
feat: visual WYSIWYG email template editor
2026-03-16 09:37:57 +01:00
6f95b8c26c
feat: register Russian locale and add to language selector
...
Import ru.json translations in i18n config and add Russian with flag
to the language selector dropdown.
2026-03-16 09:35:03 +01:00
7250c427b9
fix: shorten Save button label on email template editor
...
Change "Save Changes" to "Save" for cleaner toolbar layout.
2026-03-16 09:29:24 +01:00
04a7ea80f9
feat: add visual WYSIWYG email template editor ( #229 )
...
Replace raw HTML textarea with TipTap-based rich text editor for email
templates. Includes formatting toolbar, variable insertion dropdown,
source/visual toggle, and dark mode support. Add Mailhog service to
docker-compose for local email testing.
2026-03-15 22:05:27 +01:00
c0a5cd56c8
Merge pull request #232 from the-luap/i18n/ru-missing-keys
...
i18n: add missing Russian translations for thumbnails and photo dimensions
2026-03-15 20:12:22 +01:00
908ab08815
Merge beta to resolve conflicts for PR #232
2026-03-15 20:02:27 +01:00
52ab609597
i18n: add missing Russian translations for thumbnails and photo dimensions
...
Adds 38 missing keys for settings.thumbnails and settings.photoDimensions
that were added after the initial Russian localization PR (#216 ).
2026-03-15 19:48:41 +01:00
fafcfbf4e6
Merge pull request #216 from Ih0rd/russian-localization
...
basic Russian localization
2026-03-15 19:47:25 +01:00
f07602553c
Merge pull request #228 from the-luap/release-please--branches--beta
...
Build and Push Docker Images / build-backend (push) Failing after 3m24s
Build and Push Docker Images / build-frontend (push) Failing after 3m25s
Build and Push Docker Images / summary (push) Successful in 3s
chore(beta): release 3.17.2-beta.0
2026-03-11 21:54:58 +01:00
56f497c5f1
Merge pull request #227 from the-luap/release-please--branches--main
...
Build and Push Docker Images / build-backend (push) Failing after 3m29s
Build and Push Docker Images / build-frontend (push) Failing after 3m40s
Build and Push Docker Images / summary (push) Successful in 3s
chore(main): release 2.6.1
2026-03-11 21:54:39 +01:00
d2663bff81
chore(beta): release 3.17.2-beta.0
2026-03-11 19:48:06 +00:00
b52cf1f741
chore(main): release 2.6.1
2026-03-11 19:48:05 +00:00
308e086263
Merge pull request #226 from the-luap/fix/security-reporting-policy
...
fix: update security policy with private reporting channels
2026-03-11 20:47:51 +01:00
7f7736282f
Merge pull request #225 from the-luap/fix/security-reporting-policy
...
fix: update security policy with private reporting channels
2026-03-11 20:47:41 +01:00
67b0f32456
fix: update security policy with proper contact email and private reporting
...
- Replace placeholder security@example.com with info@picpeak.app
- Add GitHub Private Vulnerability Reporting links
- Update supported versions table to 2.x.x
Closes #223
2026-03-11 20:21:32 +01:00
25b40c03b0
Merge pull request #224 from the-luap/release/beta-to-main
...
Merge beta into main
2026-03-11 20:19:10 +01:00
Paul Nothaft