J3vb/OwnCord
1
0
Fork 0
mirror of https://github.com/J3vb/OwnCord.git synced 2026-09-03 03:50:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix: address remaining code review findings (C-3, H-5, H-6, M-1 through M-16)

Browse Source 
- C-3: inject setupLimiter into NewAdminAPI instead of package-level global
- H-5: generateRandomKey returns error instead of panicking
- H-6: replace init() bcrypt with sync.Once lazy initialization
- M-2: remove unsafe-inline from admin CSP script-src and style-src
- M-3: sanitize upload filenames (strip control chars, truncate to 255)
- M-5: truncate User-Agent to 512 bytes before storing as device
- M-10: MaxBodySizeUnless uses prefix matching instead of exact path
- M-12: wrap seedExistingDatabase in a single transaction
- M-13: use errors.Is for EOF check in upload handler
- M-14: log writeJSON encoding errors instead of discarding
- M-16: standardize error codes to INTERNAL_ERROR across all handlers
This commit is contained in:
jevb
2026-03-31 19:00:17 +02:00
parent 694007d5a4
commit 28f33644de
15 changed files with 166 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Server/api/dm_handler.go
+5 -5
View File
@@ -88,7 +88,7 @@ func handleCreateDM(database *db.DB) http.HandlerFunc {
if err != nil {
slog.Error("handleCreateDM GetUserByID", "err", err, "recipient_id", req.RecipientID)
writeJSON(w, http.StatusInternalServerError, errorResponse{
Error: "INTERNAL",
Error: "INTERNAL_ERROR",
Message: "failed to look up recipient",
})
return
@@ -107,7 +107,7 @@ func handleCreateDM(database *db.DB) http.HandlerFunc {
slog.Error("handleCreateDM GetOrCreateDMChannel", "err", err,
"user_id", user.ID, "recipient_id", req.RecipientID)
writeJSON(w, http.StatusInternalServerError, errorResponse{
Error: "INTERNAL",
Error: "INTERNAL_ERROR",
Message: "failed to create DM channel",
})
return
@@ -154,7 +154,7 @@ func handleListDMs(database *db.DB) http.HandlerFunc {
if err != nil {
slog.Error("handleListDMs GetUserDMChannels", "err", err, "user_id", user.ID)
writeJSON(w, http.StatusInternalServerError, errorResponse{
Error: "INTERNAL",
Error: "INTERNAL_ERROR",
Message: "failed to list DM channels",
})
return
@@ -187,7 +187,7 @@ func handleCloseDM(database *db.DB, broadcaster DMBroadcaster) http.HandlerFunc
slog.Error("handleCloseDM IsDMParticipant", "err", err,
"user_id", user.ID, "channel_id", channelID)
writeJSON(w, http.StatusInternalServerError, errorResponse{
Error: "INTERNAL",
Error: "INTERNAL_ERROR",
Message: "failed to verify DM participation",
})
return
@@ -204,7 +204,7 @@ func handleCloseDM(database *db.DB, broadcaster DMBroadcaster) http.HandlerFunc
slog.Error("handleCloseDM CloseDM", "err", err,
"user_id", user.ID, "channel_id", channelID)
writeJSON(w, http.StatusInternalServerError, errorResponse{
Error: "INTERNAL",
Error: "INTERNAL_ERROR",
Message: "failed to close DM",
})
return