treamz
626a28f750
Security audit fixes synced from VPS prod: SSRF/IDOR/WS-auth/session/rate-limits/crash-guards + session journal
2026-07-24 23:34:29 +03:00
treamz
87f8c55da0
Sync prod working changes: new tools (regex/favicon), queue/session/storage/ws libs, video/compress/pdf/redirects updates
2026-07-24 16:45:55 +03:00
treamz
5c7066b7d3
Security hardening: helmet, rate limits, session fixes, admin auth
...
Critical fixes:
- helmet middleware (X-Frame-Options, HSTS, X-Content-Type, CSP, etc)
- Remove /admin from PUBLIC_PREFIXES (double auth: session + admin role)
- Session cookie: httpOnly, sameSite=lax, 1-day expiry (was 30 days)
- Session regeneration on login (prevent session fixation)
- Blocked user check on login
Rate limiting:
- /auth/login: 10 req / 15 min (brute force protection)
- /auth/register: 10 req / 15 min (spam protection)
- /parse, /metadata, /text, /preview: 20 req / min (DDoS via server)
Input sanitization:
- Strip HTML tags from display_name (stored XSS prevention)
2026-03-22 00:39:38 +03:00
treamz
1837f42a91
AdminJS admin panel + dynamic content API
...
- AdminJS at /admin with auth (admin role only)
- Manage: users, categories, tools, content blocks, settings
- DB tables: settings, categories, tools, content_blocks
- Users table: added role (user/admin) and is_blocked fields
- API: /api/settings, /api/tools, /api/content/:section
- Sidebar: admin link visible only for admin users
- Removed /logs from public routes (now in AdminJS)
- Video converter: fixed ffmpeg codecs for RPi5 (h264_v4l2m2m)
- Dependencies: sequelize, @adminjs/sequelize, mariadb
2026-03-21 23:46:41 +03:00
treamz
f8616e32b4
Auth + Landing + Categories
...
- Local auth: registration/login with email+password (bcrypt, MariaDB)
- Landing page: marketing page at / with hero, categories, advantages, CTA
- Tool categories: Images (4), Code (3), Web (3), Utilities (2)
- Sidebar: category dividers, user avatar with logout
- Protected routes: all tools require auth, landing/login/register public
- New files: lib/db.js, routes/auth.js, login.html, register.html, landing.html
- Dependencies: bcrypt, mysql2
2026-03-21 22:54:31 +03:00
