4 Commits

Author	SHA1	Message	Date
Dionisio	33cfb0faef	fix: security audit — patch vulnerabilities V-02 through V-16 ... - V-02: XSS via innerHTML in profile.js — wrap err.message in escapeHtml() - V-03: IDOR upload to other users' folders — add folder ownership check - V-04: IDOR create folders in other users' trees — add parent ownership check - V-06: Content-Disposition header injection — RFC 5987 percent-encoding - V-08: WebDAV MOVE/COPY destination without ownership — add assert_owner checks - V-09: .gitignore missing cert/key patterns — add *.pem, *.key, *.p12, etc. - V-11: Username accepts XSS payloads — restrict to [a-zA-Z0-9._-] - V-12: Minimal email validation — reject forbidden chars, require domain dot - V-13: admin_reset_password doesn't invalidate sessions — revoke all sessions - V-14: Rate limiting bypassable via X-Forwarded-For — gate behind OXICLOUD_TRUST_PROXY_HEADERS - V-15: Cookie Secure flag off by default — default to true (safe-by-default) - V-16: LIKE wildcard injection in searches — add like_escape() helper across 9 sites	2026-03-05 14:52:11 +01:00
Dionisio	1ed20f425f	perf: Phase 4+5 optimizations — uploads 10x, downloads 2x, concurrent 2x. moka cache, 512KB buffers, remove sync_all, hash-on-write, preloaded queries, bench.sh v3, gitignore storage/. 500MB upload 12.6s->1.3s (392MB/s). RSS 69-113MB, 0 swap.	2026-02-15 17:56:47 +01:00
Dionisio	76d9038e5b	fix: resolve compiler warnings and downgrade JWT secret log to warn ... - Downgrade OXICLOUD_JWT_SECRET missing log from error to warn level, since generating a random secret per session is valid behavior - Remove unused import super::* in calendar_storage_adapter tests - Remove unused import tokio_stream::StreamExt in compression_service tests - Prefix unused validate_user_ownership with _ in trash_service - Add nohup.out to .gitignore	2026-02-12 12:29:12 +01:00
root	fe19bc8505	Initial commit	2025-03-17 21:28:08 +01:00