OwnCord

mirror of https://github.com/J3vb/OwnCord.git synced 2026-09-03 03:50:00 +03:00

Files

T

jevb f3036727ae fix: address remaining code review findings (C-3, H-5, H-6, M-2 through M-16)

- C-3: inject setupLimiter into NewAdminAPI instead of package-level global
- H-5: generateRandomKey returns error instead of panicking
- H-6: replace init() bcrypt with sync.Once lazy initialization
- M-2: remove unsafe-inline from admin CSP
- M-3: sanitize upload filenames (strip control chars, truncate to 255)
- M-5: truncate User-Agent to 512 bytes before storing as device
- M-10: MaxBodySizeUnless uses prefix matching instead of exact path
- M-12: wrap seedExistingDatabase in a single transaction
- M-13: use errors.Is for EOF check in upload handler
- M-14: log writeJSON encoding errors instead of discarding
- M-16: standardize error codes to INTERNAL_ERROR across all handlers

2026-03-31 19:08:02 +02:00

auth.go

feat: implement Phase 1 server skeleton with TDD

2026-03-14 20:34:37 +01:00

helpers_test.go

feat: add Let's Encrypt ACME support, fix security issues, improve server UX

2026-03-15 07:07:59 +01:00

helpers.go

fix: atomic invite registration, fail-closed search, proxy-aware rate limiting

2026-03-29 19:39:22 +02:00

password_test.go

feat: implement Phase 2 auth & security with TDD