cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

security: fix vulnerabilities 1-7 from security audit

Browse Source 
- Fix #1: Share handler IDOR - enforce owner check on share operations
- Fix #2: list_files_query IDOR - bind folder queries to authenticated user
- Fix #3: Dedup handler IDOR - restrict dedup operations to file owner
- Fix #4: Trash handler OptionalAuthUser - require full AuthUser
- Fix #5: Error info leakage - sanitize 500 error responses
- Fix #6: Chunked upload IDOR - bind upload sessions to user_id,
  add verify_session_owner() check on all session operations
- Fix #7: CSP unsafe-inline removal - migrate all inline scripts,
  styles and event handlers to external files, tighten CSP to
  script-src 'self'; style-src 'self'

New files:
  - static/js/core/theme-init.js (render-blocking theme init)
  - static/js/core/sw-register.js (service worker registration)
  - static/css/views/device-verify.css (extracted inline styles)
  - static/js/views/device-verify/device-verify.js (extracted inline script)
This commit is contained in:
Dionisio
2026-03-05 13:15:34 +01:00
parent fdbb2bf60a
commit b503e08384
38 changed files with 870 additions and 1008 deletions
Download Patch File Download Diff File Expand all files Collapse all files
static/login.html
+5 -5
View File
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title data-i18n="app.title">OxiCloud - Login</title>
<!-- Apply saved theme immediately to prevent flash of light mode -->
<script>if(localStorage.getItem('oxicloud_theme')==='dark')document.documentElement.setAttribute('data-theme','dark');</script>
<script src="/js/core/theme-init.js"></script>
<!-- Styles -->
<link rel="stylesheet" href="/css/main.css">
@@ -20,7 +20,7 @@
<body>
<div class="auth-container">
<!-- Language Selector Panel - Shown first on fresh install -->
<div class="auth-panel language-selector-panel" id="language-panel" style="display: none;">
<div class="auth-panel language-selector-panel hidden" id="language-panel">
<div class="auth-logo">
<div class="auth-logo-icon">
<svg viewBox="0 0 500 500">
@@ -54,7 +54,7 @@
<button type="button" class="auth-button" id="language-continue">Continue</button>
</div>
<div class="auth-panel" id="login-panel" style="display: none;">
<div class="auth-panel hidden" id="login-panel">
<div class="auth-logo">
<div class="auth-logo-icon">
<svg viewBox="0 0 500 500">
@@ -97,7 +97,7 @@
</form>
<!-- SSO / OIDC login section (hidden by default, shown dynamically) -->
<div id="oidc-login-section" style="display: none;">
<div id="oidc-login-section" class="hidden">
<div class="auth-divider" id="auth-divider">
<span data-i18n="auth.or">or</span>
</div>
@@ -118,7 +118,7 @@
</div>
</div>
<div class="auth-panel" id="register-panel" style="display: none;">
<div class="auth-panel hidden" id="register-panel">
<div class="auth-logo">
<div class="auth-logo-icon">
<svg viewBox="0 0 500 500">