Paul Nothaft c6d401685f fix(security): verify the signature before writing a token to the revocation list ...

revokeToken() base64-decoded the payload without checking the signature and
inserted a row keyed on id-iat-type, the same key isTokenRevoked() matches
for real sessions. The logout endpoints are unauthenticated, so anyone could
forge a payload naming another user's id, type and login second and log them
out remotely; a far-future exp also left rows that cleanup never swept.

Expiry is still ignored so logging out an expired session stays idempotent.

(cherry picked from commit 0ca0e4a922)

2026-09-03 12:12:12 +02:00

..

__tests__

fix(security): verify the signature before writing a token to the revocation list

2026-09-03 12:12:12 +02:00

assets/fonts

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

docs

…

migrations

fix(previews): preserve alpha and animation in the preview tier (#1176)

2026-08-26 09:14:42 +02:00

scripts

fix(scripts): regenerate-thumbnails resolves external sources through ensureThumbnail (#1148) (#1155)

2026-08-23 22:06:30 +02:00

src

fix(security): verify the signature before writing a token to the revocation list

2026-09-03 12:12:12 +02:00

.dockerignore

…

.env.example

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

.eslintrc.js

…

audit-backend.json

…

dependencies-backend.json

Upgrade nodemailer to 7.0.7 (GHSA-mm7p-fcc7-pg87)

2025-10-13 21:11:38 +02:00

Dockerfile

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038) (#1040)

2026-08-13 18:51:20 +02:00

Dockerfile.dev

fix(security): scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage

2026-05-07 22:31:51 +02:00

ecosystem.config.js

…

jest.config.js

fix(tests): raise jest timeouts to the 120s convention (stable) (#902)

2026-07-29 12:48:50 +02:00

jest.setup.js

…

knexfile.js

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038) (#1040)

2026-08-13 18:51:20 +02:00

package-lock.json

chore(security): ignore unfixed CVEs in Trivy, override deepmerge-ts (#1085)

2026-08-19 13:56:10 +02:00

package.json

chore(stable): release 3.46.8 (#1250)

2026-09-01 22:29:02 +02:00

server.js

fix(security): bound password input before zxcvbn, and drop the legacy media mounts

2026-09-03 12:12:06 +02:00

test-filter.js

…

wait-for-db.sh

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038) (#1040)

2026-08-13 18:51:20 +02:00