892e47d017
feat: add multi-administrator support with RBAC and fix backup/restore for S3
...
## Multi-Administrator System
- Add role-based access control (RBAC) with predefined roles (Super Admin, Admin, Editor, Viewer)
- Add granular permissions system for all admin operations
- Add admin user management page with invite functionality
- Add email invitation system for new administrators
- Add permission middleware protecting all admin routes
- Add PermissionGate component for frontend permission checks
- Track event creator (created_by) for audit purposes
## Backup & Restore Fixes
- Fix S3 backup: endpoint URL handling, manifest loading, field name compatibility
- Fix S3 restore: add list-backups endpoint, transform S3 config from frontend format
- Fix PostgreSQL compatibility: add .returning('id') for insert operations
- Fix disk space check: use df command, handle unknown space gracefully
- Fix dry-run validation to not block on warnings
- Fix req.user → req.admin in restore routes
## Database Migrations
- 054: Add roles table with predefined roles
- 055: Add permissions table
- 056: Add role_permissions junction table
- 057: Add role_id to admin_users
- 058: Add admin_invitations table
- 059: Add admin email templates
- 060: Add created_by to events table
## Other Improvements
- Update .gitignore to exclude planning docs and local backup directory
- Remove SQLite database file from tracking
- Add i18n translations for user management (EN/DE)
2026-01-07 17:10:46 +01:00
6033461be1
feat: add Apple Liquid Glass templates, image security settings, and automated releases
...
## New Features
- Apple Liquid Glass CSS template with iOS 26-inspired design
- Liquid Glass Dark theme with neon accents
- Image Security settings tab with per-event protection levels
- Release Please automation for versioning and changelog
## Improvements
- Update CSS template migration with final working templates
- Add search placeholder visibility fix for glass themes
- Update README roadmap (Download Protection, Gallery Templates, Filtering & Export now implemented)
## Infrastructure
- Add release-please.yml workflow for automated releases
- Add release-please-config.json and manifest
- Update docker-build.yml with Release Please integration comments
- Add comprehensive CHANGELOG.md
## Cleanup
- Add working/planning docs to .gitignore (CLAUDE.md, test-*.md, feature-*.md, etc.)
- Remove internal planning documents from git tracking (kept locally)
## Files Added
- .github/workflows/release-please.yml
- .release-please-manifest.json
- release-please-config.json
- CHANGELOG.md
- frontend/src/features/settings/tabs/ImageSecurityTab.tsx
2026-01-03 23:35:23 +01:00
f3c2cee362
security: Fix critical vulnerabilities and harden application
...
## Security Fixes
### CRITICAL: Command Injection (adminBackup.js)
- Replaced exec() with spawn() using argument arrays
- Added input sanitization for host, user, and ssh_key
- Added regex validation for hostname/IP format
- Added username format validation
- Added SSH key file existence check
- Prevents shell metacharacter injection attacks
### HIGH: Hardcoded Password (set-admin-password.js)
- Removed hardcoded 'admin123' password
- Now requires password as CLI argument or env variable
- Added password strength validation (8+ chars, mixed case, numbers, special chars)
- Added --help flag with usage instructions
- Invalidates existing sessions on password change
### MEDIUM: XSS Vulnerability (WelcomeMessageEditor.tsx)
- Added DOMPurify sanitization to getPreviewHtml()
- Strips all HTML tags before rendering preview
- Prevents script injection in admin preview
### LOW: Sample Password Exposure (EmailConfigPage.tsx)
- Replaced plaintext sample password with masked placeholder
- Uses '••••••••' instead of realistic password
## Dependency Updates
- Fixed npm audit vulnerabilities (jws, qs, express)
- Backend: 0 vulnerabilities
- Frontend: 0 vulnerabilities
2026-01-03 10:12:01 +01:00
3424bd22ee
refactor: Phase 1 code consolidation and service layer setup
...
Phase 1.1: Shared parsers utility
- Create backend/src/utils/parsers.js with parseBooleanInput, parseStringInput, etc.
- Create frontend/src/utils/parsers.ts with TypeScript equivalents
- Update routes to import from shared parsers
Phase 1.2: Auth routes consolidation
- Merge auth.js, auth-enhanced.js, auth-enhanced-v2.js into single auth.js
- Add password change and password strength endpoints
- Consolidate middleware (auth.js with token revocation support)
- Update all imports across 14+ route files
Phase 1.3: CreateEvent page consolidation
- Remove duplicate CreateEventPage.tsx (basic version)
- Rename CreateEventPageEnhanced.tsx to CreateEventPage.tsx
- Update exports and imports
Phase 1.4: CMS page consolidation
- Remove duplicate CMSPage.tsx (basic version)
- Rename CMSPageEnhanced.tsx to CMSPage.tsx
- Update exports and imports
Phase 1.5: Multer config factory
- Create backend/src/config/multerConfig.js
- Centralized upload configuration with presets for photos, logos, favicons
- Reusable helpers: createDiskStorage, createFileFilter, uploadTimeoutMiddleware
Phase 2.1: Event service layer
- Create backend/src/services/eventService.js
- Move event business logic out of routes
- Functions: createEvent, getAllEvents, updateEvent, deleteEvent, extendExpiration
2026-01-02 10:12:24 +01:00
8315c11d34
Update backend package-lock.json for npm compatibility
...
Regenerate lock file to include missing transitive dependencies
(encoding, iconv-lite) required by newer npm versions.
2025-11-28 17:54:36 +01:00
68a9dc5749
Add comprehensive video support to galleries
...
This commit implements full video upload, storage, streaming, and playback functionality
for the PicPeak photo sharing platform, allowing users to upload and view videos alongside
photos in galleries.
Backend Changes:
- Added video processing dependencies (fluent-ffmpeg, @ffmpeg-installer/ffmpeg)
- Created videoProcessor.js service for video metadata extraction and thumbnail generation
- Updated photoProcessor.js to handle both images and videos
- Modified adminPhotos.js to accept video files with 500MB size limit
- Enhanced gallery.js with HTTP range request support for video streaming
- Expanded fileSecurityUtils.js with video MIME types and magic number validation
- Added database migration for video support columns (media_type, duration, codecs, dimensions)
Frontend Changes:
- Updated TypeScript types to include video metadata fields
- Created VideoPlayer.tsx component with custom controls
- Modified PhotoUpload.tsx to accept video files (.mp4, .webm, .mov, .avi)
- Updated UserPhotoUpload.tsx for guest video uploads
- Enhanced PhotoGrid.tsx with video badges and duration display
- Modified PhotoLightbox.tsx to conditionally render VideoPlayer for videos
Database Schema:
- Added media_type column ('image' | 'video')
- Added mime_type, duration, video_codec, audio_codec columns
- Added width and height columns for media dimensions
- Migrated existing photos to media_type 'image'
Features:
- Video thumbnail generation from video frames
- Streaming support with range requests for efficient playback
- Video duration display on thumbnails
- Play button indicators on video items
- Full-featured video player with playback controls
- Support for MP4, WebM, MOV, and AVI formats
2025-11-28 17:53:56 +01:00
paul
bce5f749b1
Merge remote-tracking branch 'upstream/main'
Build and Push Docker Images / build-backend (push) Failing after 13m5s
Build and Push Docker Images / build-frontend (push) Failing after 2m55s
Build and Push Docker Images / summary (push) Successful in 3s
2025-11-25 22:43:48 +02:00
f327f4cbcd
Update package-lock.json files to sync with security overrides
2025-11-25 20:40:29 +00:00
f29e9db99d
chore: bump version to 1.1.15 (backend + frontend)
continuous-integration/drone/push Build is passing
continuous-integration/drone/tag Build is passing
2025-10-29 11:30:46 +00:00
paul
69538b86ea
Fix mobile overlay and deps per #43
Test and Lint / backend-test (pull_request) Successful in 1m24s
Test and Lint / frontend-test (pull_request) Successful in 1m59s
continuous-integration/drone/pr Build is passing
2025-10-29 12:19:43 +01:00
b76e45cb54
chore: bump version to 1.1.14 (backend + frontend)
continuous-integration/drone/push Build is passing
continuous-integration/drone/tag Build is passing
2025-10-20 12:41:34 +00:00
07759a0e40
chore: bump version to 1.1.13 (backend + frontend)
continuous-integration/drone/push Build is passing
continuous-integration/drone/tag Build is passing
2025-10-15 05:29:19 +00:00
52f8f1f738
Upgrade nodemailer to 7.0.7 (GHSA-mm7p-fcc7-pg87)
Test and Lint / backend-test (push) Successful in 1m23s
Test and Lint / frontend-test (push) Successful in 1m53s
2025-10-13 21:11:38 +02:00
e731e7b47c
Address tar-fs CVE-2025-59343
Test and Lint / backend-test (push) Successful in 1m21s
Test and Lint / frontend-test (push) Has been cancelled
2025-10-13 21:09:52 +02:00
f20472ca26
chore: bump version to 1.1.11 (backend + frontend)
2025-10-12 19:23:19 +00:00
87f4526220
chore: bump version to 1.1.10 (backend + frontend)
2025-10-12 19:18:37 +00:00
d42a11680f
chore: bump version to 1.1.9 (backend + frontend)
2025-10-06 13:18:43 +00:00
38dd74b893
chore: bump version to 1.1.8 (backend + frontend)
2025-10-03 05:19:52 +00:00
2fe32e9a69
chore: bump backend version to 1.1.5
2025-09-27 05:59:32 +00:00
fb739f221d
chore: bump version to 1.1.4 (backend + frontend)
2025-09-24 15:39:34 +00:00
a4595e2ab2
chore: bump backend version to 1.1.3
2025-09-22 20:50:54 +00:00
cab5b0d795
chore: bump backend version to 1.1.2
2025-09-22 17:08:29 +00:00
e0865b81b6
chore: bump backend version to 1.1.1
2025-09-21 20:47:47 +00:00
paul
39d2244e1e
chore: switch versioning workflows to manual triggers
2025-09-19 22:31:55 +02:00
eb626be22c
chore: bump version to 1.0.130 (backend + frontend)
2025-09-19 14:47:37 +00:00
paul
2a4d38813f
feat: overhaul public landing page and backup tooling
2025-09-19 16:39:18 +02:00
ad9c6d63d3
chore: bump backend version to 1.0.129
2025-09-18 14:54:28 +00:00
e51347d0a1
chore: bump version to 1.0.128 (backend + frontend)
2025-09-18 14:05:43 +00:00
paul
71e7179145
Harden auth cookies and fix native schema for event creation
Mirror to GitHub / mirror (push) Successful in 45s
Test and Lint / backend-test (push) Successful in 1m37s
Test and Lint / frontend-test (push) Successful in 2m8s
Version and Release / version-bump (push) Successful in 1m0s
Version and Release / trigger-drone (push) Successful in 3s
2025-09-18 15:59:26 +02:00
bda76ff513
chore: bump backend version to 1.0.125
2025-09-18 10:49:54 +00:00
0d77a3a0a8
chore: bump version to 1.0.124 (backend + frontend)
2025-09-14 14:25:37 +00:00
aa9b3a0227
chore: bump version to 1.0.123 (backend + frontend)
2025-09-14 13:53:37 +00:00
05ebaaeedb
chore: bump version to 1.0.122 (backend + frontend)
2025-09-09 18:54:09 +00:00
6a4b549d9f
chore: bump version to 1.0.121 (backend + frontend)
2025-09-09 18:45:28 +00:00
531831e84b
chore: bump backend version to 1.0.120
2025-09-09 18:28:39 +00:00
4264026bbe
chore: bump backend version to 1.0.119
2025-09-09 18:06:15 +00:00
ba825823a0
chore: bump backend version to 1.0.118
2025-09-09 17:58:50 +00:00
8404125ff0
chore: bump version to 1.0.117 (backend + frontend)
2025-09-09 17:10:38 +00:00
9fd6b44487
chore: bump version to 1.0.116 (backend + frontend)
2025-09-09 15:47:41 +00:00
f2abb40987
chore: bump version to 1.0.115 (backend + frontend)
2025-09-09 15:32:47 +00:00
4aa0ff705f
chore: bump version to 1.0.114 (backend + frontend)
2025-09-09 15:25:05 +00:00
448882cfef
chore: bump version to 1.0.113 (backend + frontend)
2025-09-09 13:31:10 +00:00
798f6211e0
chore: bump version to 1.0.112 (backend + frontend)
2025-09-09 09:46:52 +00:00
afeb35a446
chore: bump version to 1.0.111 (backend + frontend)
2025-09-06 07:22:38 +00:00
78ab0ad2e9
chore: bump version to 1.0.110 (backend + frontend)
2025-09-05 22:06:43 +00:00
1d826accdc
chore: bump version to 1.0.109 (backend + frontend)
2025-09-05 13:07:58 +00:00
f7a8765f58
chore: bump version to 1.0.108 (backend + frontend)
2025-09-02 15:46:57 +00:00
0881a0fa71
chore: bump version to 1.0.106 (backend + frontend)
2025-09-01 21:03:36 +00:00
7b517fa290
chore: bump version to 1.0.105 (backend + frontend)
2025-08-29 20:28:39 +00:00
0c283717cb
chore: bump version to 1.0.104 (backend + frontend)
2025-08-29 20:13:18 +00:00
Paul Nothaft
paul