Paul Nothaft 662516a5ad fix: retain revocations for tokens without expiry

2026-09-08 15:54:01 +02:00

..

__tests__

style(backend): clear the eslint backlog to zero

2026-09-01 16:46:34 +02:00

appSettings.js

feat(workflows): wire booking document actions (prepare_invoice/contract + send_document)

2026-06-26 23:48:12 +02:00

authSecurity.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

businessHours.js

feat(email): per-weekday business hours + manual queue flush

2026-06-02 13:00:13 +02:00

categoryOrder.js

fix(categories): address PR #790 review — event ownership, migration renumber, nits

2026-07-10 20:10:40 +02:00

cleanupTempUploads.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

clientIp.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

cssSanitizer.js

fix(security): validate CSS urls last, after every pass that moves text

2026-09-05 15:30:04 +02:00

databaseEngine.js

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038) (#1039)

2026-08-13 18:50:56 +02:00

dateFormatter.js

refactor(backend): standardize error responses, logging, pagination

2026-07-03 07:49:45 +02:00

dateNormalize.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

dbCompat.js

refactor(backend): standardize error responses, logging, pagination

2026-07-03 07:49:45 +02:00

dbErrors.js

fix(auth): fail closed when the adminAuth roles join errors (#974)

2026-08-03 14:48:20 +02:00

documentSequences.js

refactor: remove dead files, dedupe formatBytes and document numbering helpers

2026-07-03 07:25:07 +02:00

downloadResolutions.js

feat(downloads): per-gallery download resolutions (#858) (#1022)

2026-08-11 09:46:46 +02:00

emailNormalization.js

fix(email): preserve dots + subaddresses across all normalization sites (#574)

2026-05-29 11:42:25 +02:00

emailSecretRedaction.js

fix(email): scrub gallery passwords from the sent-mail archive (#1340)

2026-09-07 20:02:57 +02:00

errors.js

feat: Add CSS template system with custom gallery styling support

2026-01-03 08:59:01 +01:00

feedbackValidation.js

fix(security): stop reflecting submitted values in validation errors everywhere, cap credential lengths, close the login timing oracle

2026-09-03 10:53:30 +02:00

filenameSanitizer.js

style(backend): clear the eslint backlog to zero

2026-09-01 16:46:34 +02:00

fileSecurityUtils.js

fix(upload): scope category ids, stop temp-file leaks, split the video cap

2026-09-02 09:43:10 +02:00

formatBytes.js

refactor: remove dead files, dedupe formatBytes and document numbering helpers

2026-07-03 07:25:07 +02:00

formatters.js

fix(email): render conditionals, localise password placeholders, fix caller/template variable drift

2026-05-03 22:06:06 +02:00

frontendUrl.js

feat(setup): configure the public address and SMTP in the wizard, not .env (#1104)

2026-08-21 12:54:14 +02:00

galleryLifecycle.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

galleryPasswordVault.js

feat(security): opt-in recoverable gallery passwords (#1341)

2026-09-07 20:36:48 +02:00

iban.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

interruptibleSleep.js

fix: interrupt idle worker waits during shutdown

2026-09-08 15:54:01 +02:00

invoiceRounding.js

feat(invoices): optional sub-cent rounding reconciliation ("Rundung" row)

2026-06-28 15:53:44 +02:00

logger.js

feat(docker): all-in-one image (#1042) — my version of #1067 (#1068)

2026-08-18 22:15:49 +02:00

networkValidation.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

numericHelpers.js

fix: mirror #734 onto decomposed files (PG NaN slideshow seed, SQLite bool renders)

2026-07-03 09:01:01 +02:00

parsers.js

refactor: Phase 1 code consolidation and service layer setup

2026-01-02 10:12:24 +01:00

passwordGenerator.js

style(backend): clear the eslint backlog to zero

2026-09-01 16:46:34 +02:00

passwordInput.js

fix(gallery): block password form in Instagram in-app browser and unmask login errors (#863)

2026-07-23 21:45:07 +02:00

passwordValidation.js

fix(security): enforce the strength-endpoint validators, and stop the generator spinning

2026-09-03 09:39:50 +02:00

pdfFilename.js

fix(pdf): RFC 6266-encode Content-Disposition on quote/invoice PDFs (#1024) (#1055)

2026-08-16 19:31:19 +02:00

pgConnection.js

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038) (#1039)

2026-08-13 18:50:56 +02:00

photoContentType.js

fix(security): never serve a photo under its stored MIME, and stop trusting the chunked-upload type

2026-09-03 10:48:56 +02:00

photoFilterBuilder.js

feat(api): Lightroom round-trip — read proofing marks, put finished edits back (#745) (#1165)

2026-08-28 15:45:56 +02:00

photoVisibility.js

fix(security): block guest access to hidden/client-only photos across bulk + secure routes (#939)

2026-08-01 17:36:15 +02:00

pinnedRequest.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

publicTokenGuards.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

queueTimestamps.js

fix(email): read naive SQLite timestamps as UTC, and page the candidates

2026-09-02 14:57:00 +02:00

rateLimitSecurity.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

requestIp.js

fix: address Shannon security assessment findings (37 vulnerabilities) (#254)

2026-03-22 12:40:01 +01:00

requestLogPath.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

requestOrigin.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

resolveLogoFile.js

fix(security): unauth share_token leak (HIGH) + restore path-traversal, logo file-read, branding path keys (#946)

2026-08-02 08:37:48 +02:00

revealMode.js

fix(security): close four middleware gaps around the API edge

2026-09-03 10:51:53 +02:00

routeHelpers.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

safeExec.js

fix(safe-exec): Node 22-compatible stdio + error-bridge for spawnTo/FromFile

2026-05-30 03:26:10 +02:00

safePath.js

fix(security): contain logo, favicon and PDF-logo unlinks to their upload directories

2026-09-03 10:44:55 +02:00

sanitizeForLog.js

fix(security): bound inbound-mail resources, redact secrets from logs (GHSA-2qf9, pgmp, r794) (#959)

2026-08-02 21:17:11 +02:00

schemaCache.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

sessionCutoff.js

feat(security): harden .picpeak restore robustness — sessions, roles, sequences

2026-07-16 12:56:34 +02:00

shareLinkUtils.js

Add short gallery URL toggle and token support (#38)

2025-10-15 07:21:09 +02:00

slideshowGlobals.js

feat(slideshow): guest-scannable share-link QR overlay (#848)

2026-07-19 22:36:03 +02:00

slug.js

refactor(slug): extract shared slugify util + scope adminPhotos category lookup (#525)

2026-05-18 23:50:35 +02:00

spreadsheetSafe.js

fix(accounting): PR #622 blockers — CSV formula injection + IMAP double-ingest race

2026-06-16 18:21:02 +02:00

sqlitePath.js

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038) (#1039)

2026-08-13 18:50:56 +02:00

sqlSecurity.js

fix(search): stop escapeLikePattern corrupting bound search values

2026-09-02 09:43:10 +02:00

streamResponse.js

fix: single-photo gallery downloads 404 on S3 storage backends (#1048)

2026-09-01 08:17:32 +02:00

timingSafe.js

fix(security): close cross-event thumbnail leak, bulk-op ownership bypass, + hardening

2026-07-03 10:27:28 +02:00

tokenRevocation.js

fix: retain revocations for tokens without expiry

2026-09-08 15:54:01 +02:00

tokenUtils.js

feat(auth): make the admin "Remember me" checkbox actually do something (#1186) (#1195)

2026-08-26 21:13:23 +02:00

whatsNew.js

style(backend): clear the eslint backlog to zero

2026-09-01 16:46:34 +02:00