Paul Nothaft 8a87c9274b fix(security): block guest access to hidden/client-only photos across bulk + secure routes (#939) ...

* fix(security): block guest access to hidden/client-only photos across bulk + secure routes

* fix(security): harden hidden-photo fix per review (stale ZIP cache, legacy token mint, SQLite bool, client rebuild)

* fix(security): invalidate ZIP cache on photo visibility/category change (codex r2)

* fix(security): recheck photo visibility at signed/secure serve time (TOCTOU) + invalidate ZIP on client visibility change (codex r3)

---------

Co-authored-by: Paul Nothaft <paul@MacStudio-von-Paul.local>

2026-08-01 17:36:15 +02:00

..

__tests__

fix(security): block guest access to hidden/client-only photos across bulk + secure routes (#939)

2026-08-01 17:36:15 +02:00

assets/fonts

feat(events): gallery QR code + printable table-card/poster PDFs (#847)

2026-07-19 22:35:44 +02:00

docs

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

migrations

feat(gallery): per-event toggle to hide the logo on the password page (#894) (#928)

2026-07-31 08:56:48 +02:00

scripts

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

src

fix(security): block guest access to hidden/client-only photos across bulk + secure routes (#939)

2026-08-01 17:36:15 +02:00

.dockerignore

chore(backend): ignore runtime storage in git/docker, remove dead getSafeFilename

2026-07-19 00:40:53 +02:00

.env.example

fix(file-watcher): bound concurrent photo processing (#846)

2026-07-19 22:00:46 +02:00

.eslintrc.js

…

audit-backend.json

…

dependencies-backend.json

…

Dockerfile

fix(security): close 5 Trivy alerts — postcss/tar bumps + drop npm from the runtime image (#878)

2026-07-27 09:54:33 +02:00

Dockerfile.dev

fix(uploads): RAW derivative key collision, watermark skip, dev exiftool (codex review of #833 round 2)

2026-07-17 22:50:24 +02:00

ecosystem.config.js

…

jest.config.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

jest.setup.js

…

knexfile.js

…

package-lock.json

fix(security): bump sanitize-html to 2.17.5 (CVE-2026-53606) (#937)

2026-08-01 17:36:09 +02:00

package.json

fix(security): bump sanitize-html to 2.17.5 (CVE-2026-53606) (#937)

2026-08-01 17:36:09 +02:00

server.js

feat(gallery): reveal mode — hide gallery from guests until reveal (#838) (#856)

2026-07-22 20:59:59 +02:00

test-filter.js

…

wait-for-db.sh

fix(security): close 5 Trivy alerts — postcss/tar bumps + drop npm from the runtime image (#878)

2026-07-27 09:54:33 +02:00