fix(#106): [SECURITY] scope recent files and favorites per user

Root cause: localStorage keys 'oxicloud_recent_files' and
'oxicloud_favorites' were global — shared across all users on the same
browser. When user A logged out and user B logged in, user B could see
(and access) user A's recent files and favorites.

Fixes applied:

recent.js:
- Storage key now user-specific: 'oxicloud_recent_files_{username}'
- getStorageKey() derives key from current user in localStorage
- migrateFromLegacyKey() moves data from old global key on init
- Legacy global key is always removed after migration

favorites.js:
- Same pattern: 'oxicloud_favorites_{username}'
- getStorageKey() + migrateFromLegacyKey() added

auth.js (logout):
- Clears user-specific recent and favorites keys before removing
  user data, plus removes any legacy global keys

Bumps service worker cache to v13.

This commit is contained in:

Dionisio

2026-02-14 12:50:44 +01:00

parent ebb0aee84e

commit f25987e553

4 changed files with 105 additions and 13 deletions

									
										static/sw.js
									
		+1
		-1
	
												View File
												
				@@ -1,5 +1,5 @@

				// OxiCloud Service Worker

				const CACHE_NAME = 'oxicloud-cache-v12';

				const CACHE_NAME = 'oxicloud-cache-v13';

				const ASSETS_TO_CACHE = [

				  '/',

				  '/index.html',