mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
jevb
76cb9b9630
Security fixes (from multi-reviewer code review): - Add DM participant auth checks to channel_focus, typing, and REST message endpoints — prevents unauthorized access to DM channels - Fix TOCTOU race in GetOrCreateDMChannel using IMMEDIATE transaction - Validate YAML credentials before LiveKit config interpolation - Add CSS variable injection prevention in custom theme loader - Validate localStorage JSON before unsafe type casts LiveKit stability: - Track remote mic audio elements for cleanup on abnormal disconnect - Remove duplicate token refresh timer scheduling - Add .catch() to all floating applyMicMuteState promises - Clear reconnectAc after async post-connect work completes - Fix double cmd.Wait() race in LiveKit process Stop() - Reorder voice_join guards: validate channel before livekit==nil check - Add startup warning for external LiveKit webhook CIDR mismatch DM system fixes: - Emit dm_channel_close WebSocket event from REST close handler - Re-open DM for caller when channel already exists - Fix unread count incrementing for own messages and active DMs - Reset channelBeforeDm after Back navigation (stale state bug) New feature: - Voice call duration timer in VoiceWidget (MM:SS / HH:MM:SS elapsed) - Accent color restored on app startup (was only applied in settings) Test infrastructure: - Add DM tables to all test schemas (hubTestSchema) - Inject test LiveKit client in voice handler tests (fixes 28 failures)