Paul Nothaft f3c2cee362 security: Fix critical vulnerabilities and harden application ...

## Security Fixes

### CRITICAL: Command Injection (adminBackup.js)
- Replaced exec() with spawn() using argument arrays
- Added input sanitization for host, user, and ssh_key
- Added regex validation for hostname/IP format
- Added username format validation
- Added SSH key file existence check
- Prevents shell metacharacter injection attacks

### HIGH: Hardcoded Password (set-admin-password.js)
- Removed hardcoded 'admin123' password
- Now requires password as CLI argument or env variable
- Added password strength validation (8+ chars, mixed case, numbers, special chars)
- Added --help flag with usage instructions
- Invalidates existing sessions on password change

### MEDIUM: XSS Vulnerability (WelcomeMessageEditor.tsx)
- Added DOMPurify sanitization to getPreviewHtml()
- Strips all HTML tags before rendering preview
- Prevents script injection in admin preview

### LOW: Sample Password Exposure (EmailConfigPage.tsx)
- Replaced plaintext sample password with masked placeholder
- Uses '••••••••' instead of realistic password

## Dependency Updates
- Fixed npm audit vulnerabilities (jws, qs, express)
- Backend: 0 vulnerabilities
- Frontend: 0 vulnerabilities

2026-01-03 10:12:01 +01:00

..

__tests__

Fix admin reference mode regressions

2025-10-02 23:39:17 +02:00

data

feat: Add CSS template system with custom gallery styling support

2026-01-03 08:59:01 +01:00

docs

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

migrations

feat: Add CSS template system with custom gallery styling support

2026-01-03 08:59:01 +01:00

scripts

security: Fix critical vulnerabilities and harden application

2026-01-03 10:12:01 +01:00

src

security: Fix critical vulnerabilities and harden application

2026-01-03 10:12:01 +01:00

.dockerignore

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

.env.example

refactor: complete configuration cleanup and consistency fixes

2025-07-24 21:13:52 +02:00

.eslintrc.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

audit-backend.json

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

dependencies-backend.json

Upgrade nodemailer to 7.0.7 (GHSA-mm7p-fcc7-pg87)

2025-10-13 21:11:38 +02:00

Dockerfile

Fix npm ci command for newer npm versions

2025-11-28 17:54:36 +01:00

Dockerfile.dev

Fix security vulnerabilities detected by Trivy

2025-11-25 20:35:59 +00:00

ecosystem.config.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

init-production.sh

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

jest.config.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

jest.setup.js

feat: overhaul public landing page and backup tooling

2025-09-19 16:39:18 +02:00

knexfile.js

Fix PicPeak regressions and close #22 #24 #25 #26 #27 #28

2025-09-21 22:03:07 +02:00

package-lock.json

security: Fix critical vulnerabilities and harden application

2026-01-03 10:12:01 +01:00

package.json

Add comprehensive video support to galleries

2025-11-28 17:53:56 +01:00

server.js

feat: Add CSS template system with custom gallery styling support

2026-01-03 08:59:01 +01:00

test-filter.js

docs: fix deployment/admin routing and CORS guidance; add AGENTS.md; ignore AGENTS.md (refs #18)

2025-09-05 15:01:16 +02:00

wait-for-db.sh

Fix worker service and Docker storage permission issues (Issues #66, #67)

2025-11-28 17:54:36 +01:00