Paul Nothaft 31bc01cb4b fix(security): sanitize chunked-upload filename (GHSA-pc72-jf53-w28j) ...

The chunked video upload stored req.body.filename unmodified and later built
the merged path as path.join(tempDir, uploadMeta.filename). path.join does not
neutralise '../', so a filename like '../../uploads/logos/evil.svg' escaped the
temp dir on merge and overwrote arbitrary files. Requires admin with
photos.upload.

Fix: path.basename() the client filename in initializeUpload() and reject
names that collapse to nothing. Adds a regression test.

2026-07-16 10:55:10 +02:00

..

__tests__

fix(security): sanitize chunked-upload filename (GHSA-pc72-jf53-w28j)

2026-07-16 10:55:10 +02:00

assets/fonts

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

docs

…

migrations

feat(setup): event-types step in first-run wizard + un-hardcode event type deps (#800)

2026-07-15 21:30:23 +02:00

scripts

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

src

fix(security): sanitize chunked-upload filename (GHSA-pc72-jf53-w28j)

2026-07-16 10:55:10 +02:00

.dockerignore

…

.env.example

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

.eslintrc.js

…

audit-backend.json

…

dependencies-backend.json

…

Dockerfile

chore(security): bump backend npm 10 -> 11 to patch bundled sigstore/tar

2026-07-02 17:16:09 +02:00

Dockerfile.dev

fix(security): scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage

2026-05-07 22:31:51 +02:00

ecosystem.config.js

…

jest.config.js

…

jest.setup.js

…

knexfile.js

…

package-lock.json

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

package.json

chore(main): release 3.88.0-beta.0 (#805)

2026-07-15 21:07:21 +00:00

server.js

feat(setup): validate setup token at step 1 before advancing

2026-07-02 15:18:22 +02:00

test-filter.js

…

wait-for-db.sh

feat: zero-config first run — in-browser admin bootstrap + auto-generated secrets

2026-07-01 14:49:18 +02:00