Dev - #143

Merged

kkoishichan merged 11 commits into

mainfrom

Mar 10, 2026

Commits on Mar 10, 2026

fix(security): harden cookie attributes, SQL injection prevention, and permissions policy

4rthurCai
authored and
kkoishichan
committed
f0d18e7
fix(auth): sync token state between Axios interceptor and Pinia store

4rthurCai
authored and
kkoishichan
committed
564d39c
refactor(backend): extract shared file deletion helper and remove redundant admin checks

4rthurCai
authored and
kkoishichan
committed
a991a6f
docs: update all documentation to reflect current codebase

4rthurCai
authored and
kkoishichan
committed
5d46e11
fix(security): break taint flow in ORDER BY to satisfy CodeQL analysis

4rthurCai
authored and
kkoishichan
committed
27b9d10
fix(security): guard X-Forwarded-Proto behind TrustProxy config and simplify path validation

4rthurCai
authored and
kkoishichan
committed
8ae8b04
fix(frontend): use Chinese error message, add crypto.randomUUID fallback, document callback

4rthurCai
authored and
kkoishichan
committed
ea205ef
docs: add TRUST_PROXY to configuration reference

4rthurCai
authored and
kkoishichan
committed
fc1c854
fix(security): always set cookie Secure=true to satisfy CodeQL

4rthurCai
authored and
kkoishichan
committed
c7fd50b
fix(frontend): guard crypto fallback and restore logout auth check

4rthurCai
authored and
kkoishichan
committed
b8226ac
docs: fix rate limiting description from sliding-window to fixed-window

4rthurCai
authored and
kkoishichan
committed
3762018