Paul Nothaft f3c2cee362 security: Fix critical vulnerabilities and harden application ...

## Security Fixes

### CRITICAL: Command Injection (adminBackup.js)
- Replaced exec() with spawn() using argument arrays
- Added input sanitization for host, user, and ssh_key
- Added regex validation for hostname/IP format
- Added username format validation
- Added SSH key file existence check
- Prevents shell metacharacter injection attacks

### HIGH: Hardcoded Password (set-admin-password.js)
- Removed hardcoded 'admin123' password
- Now requires password as CLI argument or env variable
- Added password strength validation (8+ chars, mixed case, numbers, special chars)
- Added --help flag with usage instructions
- Invalidates existing sessions on password change

### MEDIUM: XSS Vulnerability (WelcomeMessageEditor.tsx)
- Added DOMPurify sanitization to getPreviewHtml()
- Strips all HTML tags before rendering preview
- Prevents script injection in admin preview

### LOW: Sample Password Exposure (EmailConfigPage.tsx)
- Replaced plaintext sample password with masked placeholder
- Uses '••••••••' instead of realistic password

## Dependency Updates
- Fixed npm audit vulnerabilities (jws, qs, express)
- Backend: 0 vulnerabilities
- Frontend: 0 vulnerabilities

2026-01-03 10:12:01 +01:00

..

public

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

scripts

Fix mobile overlay and deps per #43

2025-10-29 12:19:43 +01:00

src

security: Fix critical vulnerabilities and harden application

2026-01-03 10:12:01 +01:00

.dockerignore

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

.env.example

fix: resolve port configuration issues and database column mismatch

2025-08-24 11:11:53 +02:00

.env.production.example

chore: consolidate and update deployment documentation

2025-07-24 16:57:07 +02:00

.gitignore

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

audit-frontend.json

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

Dockerfile

Fetch patched libpng from edge for frontend runtime

2025-11-28 17:54:56 +01:00

Dockerfile.dev

Fix security vulnerabilities detected by Trivy

2025-11-25 20:35:59 +00:00

Dockerfile.prod

Fix security vulnerabilities detected by Trivy

2025-11-25 20:35:59 +00:00

eslint.config.js

Fix mobile overlay and deps per #43

2025-10-29 12:19:43 +01:00

index.html

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

nginx.conf

feat: overhaul public landing page and backup tooling

2025-09-19 16:39:18 +02:00

nginx.dev.conf

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

package-lock.json

refactor: Phase 1 code consolidation and service layer setup

2026-01-02 10:12:24 +01:00

package.json

Merge remote-tracking branch 'upstream/main'

2025-11-25 22:43:48 +02:00

postcss.config.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

tailwind.config.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

TEST_PLAN.md

feat: Add CSS template system with custom gallery styling support

2026-01-03 08:59:01 +01:00

tsconfig.app.json

feat: overhaul public landing page and backup tooling

2025-09-19 16:39:18 +02:00

tsconfig.json

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

tsconfig.node.json

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

vite.config.ts

feat: Add CSS template system with custom gallery styling support

2026-01-03 08:59:01 +01:00

vitest.setup.ts

Fix admin reference mode regressions

2025-10-02 23:39:17 +02:00