picpeak

Files

T

Trung-Tin Pham 7c0c5c1cda fix(upload): let the csrf gate pass application/octet-stream chunks (#1401 )

The chunked upload route reads the raw request body and its only client
sends application/octet-stream, but the CSRF gate on /api rejected every
such request with 415 before it reached the route. The endpoint had never
accepted a chunk.

The gate's origin check is the CSRF defence. Its Content-Type list only
has to keep out what a cross-site page can send without a preflight, and
octet-stream is not one of those: a form cannot produce it and fetch()
with it is not CORS-safelisted. Accept it. express.json leaves an
octet-stream body unread, so JSON routes see an empty body as before.

Fixes PicPeak/picpeak#1377

2026-09-11 10:42:07 +02:00

adminAuthRoleFallback.test.js

fix(auth): fail closed when the adminAuth roles join errors (#974 )

2026-08-03 14:48:20 +02:00

apiRateLimitGate.test.js

fix(security): close the case-sensitivity bypass in the API rate limiter

2026-09-02 09:43:11 +02:00

apiTokenRoleFallback.test.js

fix(auth): fail closed when the adminAuth roles join errors (#974 )

2026-08-03 14:48:20 +02:00

authMustChangePassword.test.js

fix(backend): use the strong password generator for resets and enforce must_change_password (#1387 )