Paul Nothaft e732e13f24 fix(uploads): DNG magic must be a single entry (.every validation) ...

The magic-number check in validateFileContent uses .every(), so the two
endianness entries (II + MM) could never both match — an admin DNG upload would
be rejected at content validation. Use the little-endian II magic only (Apple
ProRAW / camera DNGs); a rare big-endian DNG fails the check and is rejected,
which is safe since the embedded-preview extraction validates real content.

2026-07-17 22:07:32 +02:00

..

__tests__

feat(uploads): DNG / camera-RAW support via embedded-preview extraction (#821)

2026-07-17 21:51:21 +02:00

assets/fonts

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

docs

…

migrations

fix(oidc): security + robustness hardening from codex review rounds 1-2

2026-07-16 09:41:48 +02:00

scripts

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

src

fix(uploads): DNG magic must be a single entry (.every validation)

2026-07-17 22:07:32 +02:00

.dockerignore

…

.env.example

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

.eslintrc.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

audit-backend.json

…

dependencies-backend.json

Upgrade nodemailer to 7.0.7 (GHSA-mm7p-fcc7-pg87)

2025-10-13 21:11:38 +02:00

Dockerfile

feat(uploads): DNG / camera-RAW support via embedded-preview extraction (#821)

2026-07-17 21:51:21 +02:00

Dockerfile.dev

fix(security): scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage

2026-05-07 22:31:51 +02:00

ecosystem.config.js

…

jest.config.js

…

jest.setup.js

feat: overhaul public landing page and backup tooling

2025-09-19 16:39:18 +02:00

knexfile.js

Fix PicPeak regressions and close #22 #24 #25 #26 #27 #28

2025-09-21 22:03:07 +02:00

package-lock.json

feat(auth): OIDC SSO for admin users — phase 1 (#798)

2026-07-16 08:54:26 +02:00

package.json

chore(main): release 3.90.1-beta.0 (#820)

2026-07-17 07:35:38 +00:00

server.js

fix(security): remove unguarded legacy /api/events router (GHSA-4j34-x562-5vfq)

2026-07-17 09:16:51 +02:00

test-filter.js

docs: fix deployment/admin routing and CORS guidance; add AGENTS.md; ignore AGENTS.md (refs #18)

2025-09-05 15:01:16 +02:00

wait-for-db.sh

feat: zero-config first run — in-browser admin bootstrap + auto-generated secrets

2026-07-01 14:49:18 +02:00