simoleo89
b3245a18ea
fix: bootstrap admin CSRF tokens
2026-08-02 11:46:43 +02:00
openhands
17847545dd
Improvements: remove dead config, fix ESM, add URL validation, unify types, add missing logging
...
- Remove .prettierrc (dead config, Biome replaces Prettier)
- Rename lighthouserc.json to lighthouserc.cjs with module.exports for ESM compat
- Add logger.warn to empty catch blocks in auth, register, site-settings, prisma-cache, redis, security, rate-limit
- Unify ActionResult type: action-helper.ts uses 'ok' consistent with safe-action-shared.ts
- Add noUnusedLocals + noUnusedParameters to tsconfig + fix 25 pre-existing unused vars
- Replace barrel export src/types/index.ts with direct @/types/common imports
- Make trustHost conditional (development only) in auth.ts
- Add pre-flight URL validation to update-Nitrov3.sh to catch image.library.url misconfigurations
- Improve NITRO_IMAGE_LIBRARY_URL content validation in pre-flight & post-compute checks
2026-07-26 20:28:11 +02:00
openhands
d5e3bc7875
refactor: mark dead exports with TODO, deduplicate field sanitization, fix import placement
2026-07-20 14:47:05 +02:00
simoleo89 and Cursor
557138e40b
fix: admin panel resiste a fallimento cookie CSRF
...
Il layout admin non deve crashare se cookies().set() fallisce (__Host-/Secure dietro proxy). Fallback su csrf-token, meta solo con token valido.
Co-authored-by: Cursor <[email protected]
2026-07-18 19:48:30 +02:00
simoleo89 and Cursor
2de3696993
Enforce admin CSRF, harden catalog translate, use CMS hotel name for PayPal.
...
Mutating withAdmin routes now require a double-submit CSRF token; translate is capped at 500 items with audit logging; PayPal descriptions prefer siteSettings hotel_name.
Co-authored-by: Cursor <[email protected]
2026-07-18 19:38:42 +02:00
openhands
df38dccbf1
style: format code biome
2026-07-13 21:57:41 +02:00
openhands
8efd032cc6
style: format code with prettier agian
2026-07-13 21:41:52 +02:00
openhands
f6ad030c5b
Add EpicNext CMS foundation layer and fix critical security gaps
...
- Create src/lib/foundation/ (860 LOC, 9 files): typed action wrappers,
DbService with health checks, CSRF validation, safe redirects,
AsyncLocalStorage request tracing, branded types, reusable Zod schemas
- Migrate moderation.ts and user-settings.ts to foundation patterns
- Fix abuse-guard.ts: bound in-memory Maps with LRU eviction (was unbounded)
- Fix access-guard.ts: separate try/catch per check, log degradation
instead of blanket fail-open
- Replace raw redirect() calls with safeRedirect() in guard.ts and
permissions.ts to prevent open-redirect attacks
- Add CSRF validation to api-handler.ts for mutating methods
- Add canonicalizeFormData() utility for FormData input sanitization
2026-07-13 12:03:49 +02:00
simoleo89