Paul Nothaft f0e6d2dfb1 fix: enforce gallery access and consolidate gallery workflows (#1357) ...

Harden gallery authentication and authorization, consolidate gallery workflows, and prevent token-bearing URLs from leaking through nginx request error logs.

2026-09-08 15:34:09 +02:00

..

analyticsDateMerge.test.js

fix(analytics): admin dashboard reads correct fields + Umami device API (#661)

2026-06-23 17:37:41 +02:00

bannerOverridePlumbing.test.js

fix(gallery): make per-event banner overrides actually work, both banners (#440, #932) (#1064)

2026-08-16 21:37:17 +02:00

businessHours.test.js

feat(email): per-weekday business hours + manual queue flush

2026-06-02 13:00:13 +02:00

cssSanitizer.remoteUrls.test.js

fix(security): validate CSS urls last, after every pass that moves text

2026-09-05 15:30:04 +02:00

databaseEngine.test.js

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038) (#1039)

2026-08-13 18:50:56 +02:00

dbErrors.test.js

test(accounting): cover export scope, unique-violation detector, PDF page cap

2026-06-16 18:54:55 +02:00

emailNormalization.test.js

fix(email): preserve dots + subaddresses across all normalization sites (#574)

2026-05-29 11:42:25 +02:00

emailSecretRedaction.test.js

fix(email): scrub gallery passwords from the sent-mail archive (#1340)

2026-09-07 20:02:57 +02:00

feedbackColorLabels.test.js

feat(gallery): colour labels for client proofing, and one global default per feedback type (#1044) (#1137)

2026-08-23 11:15:01 +02:00

feedbackExportCameraName.test.js

fix(feedback): name the camera original in the exports, not just the stored file (#1224) (#1228)

2026-08-29 11:09:59 +02:00

feedbackPerGuestLimit.test.js

fix(tests): raise migration-boot hook timeout pins to the 120s default (#900)

2026-07-29 12:38:26 +02:00

feedbackRatingRemoval.test.js

fix(tests): raise migration-boot hook timeout pins to the 120s default (#900)

2026-07-29 12:38:26 +02:00

feedbackReactions.test.js

feat(feedback): emoji reactions on photos (#839) (#855)

2026-07-22 20:59:43 +02:00

feedbackSettingsUpdate.test.js

fix(feedback): persist guest feedback settings, unshadow the guest route (#1030) (#1031)

2026-08-13 18:50:52 +02:00

filenameSanitizer.test.js

fix(uploads): prevent cross-photo contamination from filename collisions and non-atomic writes (#931) (#933)

2026-08-01 12:29:12 +02:00

formatters.test.js

fix(email): render conditionals, localise password placeholders, fix caller/template variable drift

2026-05-03 22:06:06 +02:00

galleryInfoBanner.test.js

feat(gallery): info banner above the photo grid (#932) (#1063)

2026-08-16 21:33:13 +02:00

galleryShortUrlValidation.test.js

feat(gallery): branded URL shortener — /s/<slug> with OG injection (#699)

2026-06-30 16:30:13 +02:00

iban.test.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

invoiceRounding.test.js

feat(invoices): optional sub-cent rounding reconciliation ("Rundung" row)

2026-06-28 15:53:44 +02:00

networkValidation.dns.test.js

fix(security): resolve DNS before vetting external hostnames (SSRF cluster) (#941)

2026-08-01 17:36:21 +02:00

networkValidation.test.js

fix(security): close BOLA on photo-export + NAT64 SSRF in URL guard

2026-06-19 09:46:19 +02:00

numericHelpers.clampInt.test.js

fix(events): NaN from slideshow seed breaks event creation on PostgreSQL

2026-07-03 08:57:48 +02:00

passwordValidation.complexityKey.test.js

fix(security): read the password-complexity key the settings UI writes (#843)

2026-07-19 20:04:31 +02:00

passwordValidation.suggestionsAdvisory.test.js

fix(auth): treat zxcvbn suggestions as advice, not blocking errors (#1050)

2026-09-01 08:05:42 +02:00

pdfContentDisposition.test.js

fix(pdf): RFC 6266-encode Content-Disposition on quote/invoice PDFs (#1024) (#1055)

2026-08-16 19:31:19 +02:00

pdfFilename.test.js

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

photoContentType.test.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

photoVisibility.test.js

fix(security): block guest access to hidden/client-only photos across bulk + secure routes (#939)

2026-08-01 17:36:15 +02:00

pinnedRequest.test.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

queueTimestamps.test.js

fix(email): read naive SQLite timestamps as UTC, and page the candidates

2026-09-02 14:57:00 +02:00

requestLogPath.test.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

resolveLogoFile.test.js

fix(security): unauth share_token leak (HIGH) + restore path-traversal, logo file-read, branding path keys (#946)

2026-08-02 08:37:48 +02:00

safePathUploadedAssets.test.js

fix(security): contain logo, favicon and PDF-logo unlinks to their upload directories

2026-09-03 10:44:55 +02:00

safePathZipEntries.test.js

fix(security): reject ZIP-slip entries in archive/backup restore (GHSA-jfhw-fj23-fx6x)

2026-07-16 10:55:10 +02:00

sanitizeForLog.test.js

fix(security): bound inbound-mail resources, redact secrets from logs (GHSA-2qf9, pgmp, r794) (#959)

2026-08-02 21:17:11 +02:00

sessionCutoff.test.js

feat(security): harden .picpeak restore robustness — sessions, roles, sequences

2026-07-16 12:56:34 +02:00

spreadsheetSafe.test.js

fix(accounting): PR #622 blockers — CSV formula injection + IMAP double-ingest race

2026-06-16 18:21:02 +02:00

sqliteNullableEventDates.test.js

fix(events): make event_date/expires_at nullable on SQLite (#1029) (#1035)

2026-08-13 18:50:42 +02:00

streamResponse.test.js

fix(gallery): a missing thumbnail tier must not take the backend down (#1128)

2026-08-22 21:37:15 +02:00

testListenerAddress.test.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

tokenRevocation.forgery.test.js

fix(security): verify the signature before writing a token to the revocation list

2026-09-03 10:44:54 +02:00

whatsappBuildComponents.test.js

feat(whatsapp): admin-selectable template parameters + reorder (#647 follow-up)

2026-06-21 20:51:20 +02:00

whatsNew.test.js

fix(whatsnew): decode HTML entities and trim em-dash detail in fallback bullets

2026-06-30 18:39:21 +02:00