Paul Nothaft a929affd7e fix(security): close the case-sensitivity bypass in the API rate limiter ...

Express's `case sensitive routing` is off by default, so /API/admin/events
reaches the same handler as /api/admin/events. Both the gate's `/api/` prefix
test and rateLimitService's public-endpoint classification compared the raw
path, so simply upper-casing a letter skipped the limiter entirely.

Verified against a real Express app before fixing: /api/admin/events routes
and hits the gate; /API/admin/events and /Api/Admin/Events route and miss it.

Both now match on a lower-cased path. The auth gate added alongside was
already immune -- its patterns carry the `i` flag for exactly this reason.

Not changed: rateLimitSecurity.hasValidAdminToken's /api/admin/ test has the
same shape, but there the case-sensitive comparison fails safe -- an
upper-cased path simply does not get the admin skip, so it is rate limited
rather than exempted. Making it case-insensitive would widen a skip, so it is
left alone. maintenance.js's isAdminRoute is fail-safe for the same reason.

2026-09-02 09:43:11 +02:00

..

__tests__

fix(security): close the case-sensitivity bypass in the API rate limiter

2026-09-02 09:43:11 +02:00

assets/fonts

feat(events): gallery QR code + printable table-card/poster PDFs (#847)

2026-07-19 22:35:44 +02:00

docs

…

migrations

fix(email): repair and seed the gallery lifecycle templates

2026-09-02 09:43:10 +02:00

scripts

fix(scripts): regenerate-thumbnails resolves external sources through ensureThumbnail (#1148) (#1151)

2026-08-23 22:06:11 +02:00

src

fix(security): close the case-sensitivity bypass in the API rate limiter

2026-09-02 09:43:11 +02:00

.dockerignore

chore(backend): ignore runtime storage in git/docker, remove dead getSafeFilename

2026-07-19 00:40:53 +02:00

.env.example

fix(file-watcher): bound concurrent photo processing (#846)

2026-07-19 22:00:46 +02:00

.eslintrc.js

chore(backend): teach eslint the rest-sibling omission idiom

2026-09-02 09:43:11 +02:00

audit-backend.json

…

dependencies-backend.json

…

Dockerfile

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038) (#1039)

2026-08-13 18:50:56 +02:00

Dockerfile.dev

fix(uploads): RAW derivative key collision, watermark skip, dev exiftool (codex review of #833 round 2)

2026-07-17 22:50:24 +02:00

ecosystem.config.js

…

jest.config.js

fix(tests): raise jest timeouts to survive the growing migration chain (#860)

2026-07-22 21:27:12 +02:00

jest.setup.js

…

knexfile.js

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038) (#1039)

2026-08-13 18:50:56 +02:00

package-lock.json

chore(security): shrink the ML image's CVE surface, override deepmerge-ts (#1083)

2026-08-19 13:56:01 +02:00

package.json

chore(main): release 3.122.2-beta.0 (#1258)

2026-09-01 07:30:45 +00:00

server.js

fix(security): apply per-IP rate limiting to credential endpoints

2026-09-02 09:43:11 +02:00

test-filter.js

…

wait-for-db.sh

feat(deploy): make the all-in-one image installable without a shell (#1124)

2026-08-22 18:37:12 +02:00