paul 4e977f7624 fix(security): allow serving static files from uploads directory ...

- Remove overly restrictive absolute path check in isPathSafe
- Strip leading slash from request path before validation
- Fixes broken favicon and watermark image previews in branding page
- Path traversal protection remains intact with ../ pattern checks

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

2025-07-13 19:43:29 +02:00

..

data

fix(security): eliminate default admin password vulnerability

2025-07-12 23:50:21 +02:00

migrations

feat: implement critical security fixes for SQL injection and authentication vulnerabilities

2025-07-13 00:40:05 +02:00

scripts

feat: implement critical security fixes for SQL injection and authentication vulnerabilities

2025-07-13 00:40:05 +02:00

src

fix(security): allow serving static files from uploads directory

2025-07-13 19:43:29 +02:00

.dockerignore

Add backend .dockerignore

2025-07-03 16:29:36 +02:00

.env.example

Add backend .env.example

2025-07-03 16:29:22 +02:00

.eslintrc.js

Add backend ESLint configuration

2025-07-03 16:29:50 +02:00

AUTH_SECURITY_INTEGRATION.md

feat: implement critical security fixes for SQL injection and authentication vulnerabilities

2025-07-13 00:40:05 +02:00

AUTH_SECURITY_MIGRATION.md

feat: implement critical security fixes for SQL injection and authentication vulnerabilities

2025-07-13 00:40:05 +02:00

AUTH_SECURITY_ROLLBACK.md

feat: implement critical security fixes for SQL injection and authentication vulnerabilities

2025-07-13 00:40:05 +02:00

AUTH_SECURITY_SUMMARY.md

feat: implement critical security fixes for SQL injection and authentication vulnerabilities

2025-07-13 00:40:05 +02:00

database.db

Fix language setting not being saved to database on admin settings page

2025-07-08 09:49:45 +02:00

database.db.backup.1752359355

feat: implement critical security fixes for SQL injection and authentication vulnerabilities

2025-07-13 00:40:05 +02:00

Dockerfile

Add backend Dockerfile

2025-07-03 16:29:04 +02:00

Dockerfile.dev

Implement complete frontend with admin panel and theme system

2025-07-06 22:04:45 +02:00

ecosystem.config.js

refactor: rename project from wedding-photo-sharing to PicPeak

2025-07-12 09:22:14 +02:00

jest.config.js

Add Jest configuration

2025-07-03 16:30:03 +02:00

jest.setup.js

Add Jest setup file

2025-07-03 16:30:20 +02:00

package-lock.json

refactor: rename project from wedding-photo-sharing to PicPeak

2025-07-12 09:22:14 +02:00

package.json

refactor: rename project from wedding-photo-sharing to PicPeak

2025-07-12 09:22:14 +02:00

SAFE_AUTH_ACTIVATION_PLAN.md

feat: implement critical security fixes for SQL injection and authentication vulnerabilities

2025-07-13 00:40:05 +02:00

SECURITY_FIXES_COMPLETE.md

feat: implement critical security fixes for SQL injection and authentication vulnerabilities

2025-07-13 00:40:05 +02:00

server.js

fix(security): implement file upload security enhancements

2025-07-13 19:30:17 +02:00

server.js.backup.1752359680463

feat: implement critical security fixes for SQL injection and authentication vulnerabilities

2025-07-13 00:40:05 +02:00

SQL_INJECTION_FIX_MIGRATION.md

feat: implement critical security fixes for SQL injection and authentication vulnerabilities

2025-07-13 00:40:05 +02:00

SQL_INJECTION_FIX_ROLLBACK.md

feat: implement critical security fixes for SQL injection and authentication vulnerabilities

2025-07-13 00:40:05 +02:00

SQL_INJECTION_FIX_SUMMARY.md

feat: implement critical security fixes for SQL injection and authentication vulnerabilities

2025-07-13 00:40:05 +02:00

update_email_template.js

refactor: rename project from wedding-photo-sharing to PicPeak

2025-07-12 09:22:14 +02:00