mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
Claude
8c590c0b6d
Three review findings on the #93 feature: - RefreshChannelVisibility targeted clients by their connect-time role snapshot; a user whose role changed mid-session was evaluated against the stale role. Resolve the current role from the DB per client (fail closed). - Visibility updates are targeted, unsequenced messages, so a client that disconnected before an override change and later resumed via replay never converged (stale sidebar until a fresh connect). Track a visibility-change sequence watermark and force resumes from at/before it onto the full-ready path. - The admin SPA interpolated channel/user names into single-quoted JS strings inside onclick attributes with HTML-escaping only; a name containing a quote broke out of the string literal (XSS in the admin panel, reachable by any user allowed to create channels). Add a jsq() helper (JS-escape then HTML-escape) and use it for every onclick name interpolation. Follow-up to #93. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LwtnpHAoSFr1ZibQgQkNQK