Paul NothaftandPaul Nothaft 8a87c9274b fix(security): block guest access to hidden/client-only photos across bulk + secure routes (#939) ...

* fix(security): block guest access to hidden/client-only photos across bulk + secure routes

* fix(security): harden hidden-photo fix per review (stale ZIP cache, legacy token mint, SQLite bool, client rebuild)

* fix(security): invalidate ZIP cache on photo visibility/category change (codex r2)

* fix(security): recheck photo visibility at signed/secure serve time (TOCTOU) + invalidate ZIP on client visibility change (codex r3)

---------

Co-authored-by: Paul Nothaft <[email protected]>

2026-08-01 17:36:15 +02:00

..

analyticsDateMerge.test.js

fix(analytics): admin dashboard reads correct fields + Umami device API (#661)

2026-06-23 17:37:41 +02:00

businessHours.test.js

feat(email): per-weekday business hours + manual queue flush

2026-06-02 13:00:13 +02:00

dbErrors.test.js

test(accounting): cover export scope, unique-violation detector, PDF page cap

2026-06-16 18:54:55 +02:00

emailNormalization.test.js

fix(email): preserve dots + subaddresses across all normalization sites (#574)

2026-05-29 11:42:25 +02:00

feedbackPerGuestLimit.test.js

fix(tests): raise migration-boot hook timeout pins to the 120s default (#900)

2026-07-29 12:38:26 +02:00

feedbackRatingRemoval.test.js

fix(tests): raise migration-boot hook timeout pins to the 120s default (#900)

2026-07-29 12:38:26 +02:00

feedbackReactions.test.js

feat(feedback): emoji reactions on photos (#839) (#855)

2026-07-22 20:59:43 +02:00

filenameSanitizer.test.js

fix(uploads): prevent cross-photo contamination from filename collisions and non-atomic writes (#931) (#933)

2026-08-01 12:29:12 +02:00

formatters.test.js

fix(email): render conditionals, localise password placeholders, fix caller/template variable drift

2026-05-03 22:06:06 +02:00

galleryShortUrlValidation.test.js

feat(gallery): branded URL shortener — /s/<slug> with OG injection (#699)

2026-06-30 16:30:13 +02:00

iban.test.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

invoiceRounding.test.js

feat(invoices): optional sub-cent rounding reconciliation ("Rundung" row)

2026-06-28 15:53:44 +02:00

networkValidation.test.js

fix(security): close BOLA on photo-export + NAT64 SSRF in URL guard

2026-06-19 09:46:19 +02:00

numericHelpers.clampInt.test.js

fix(events): NaN from slideshow seed breaks event creation on PostgreSQL

2026-07-03 08:57:48 +02:00

passwordValidation.complexityKey.test.js

fix(security): read the password-complexity key the settings UI writes (#843)

2026-07-19 20:04:31 +02:00

pdfFilename.test.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

photoVisibility.test.js

fix(security): block guest access to hidden/client-only photos across bulk + secure routes (#939)

2026-08-01 17:36:15 +02:00

resolveLogoFile.test.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

safePathZipEntries.test.js

fix(security): reject ZIP-slip entries in archive/backup restore (GHSA-jfhw-fj23-fx6x)

2026-07-16 10:55:10 +02:00

sessionCutoff.test.js

feat(security): harden .picpeak restore robustness — sessions, roles, sequences

2026-07-16 12:56:34 +02:00

spreadsheetSafe.test.js

fix(accounting): PR #622 blockers — CSV formula injection + IMAP double-ingest race

2026-06-16 18:21:02 +02:00

whatsappBuildComponents.test.js

feat(whatsapp): admin-selectable template parameters + reorder (#647 follow-up)

2026-06-21 20:51:20 +02:00

whatsNew.test.js

fix(whatsnew): decode HTML entities and trim em-dash detail in fallback bullets

2026-06-30 18:39:21 +02:00