57b99f962e
fix(reset.css): use important on .hidden to override display styles
2026-04-11 11:18:05 +02:00
cb8e74375f
fix(reset.css): blank login page regression
2026-04-11 10:11:47 +02:00
1ce29c101d
style: apply biome CSS/JS format
2026-04-08 00:09:27 +02:00
5b821a7eab
refactor(empty-list): simplify empty list, will now work on list view
2026-04-03 14:16:36 +02:00
badf35f08f
chore: remove all executable attributes on non bash files
2026-04-01 23:14:42 +02:00
df336da679
feat(frontend): i18n expansion, admin/profile i18n, grid/list view fix, empty state
...
- Add 5 new locales (hi, ar, ru, ja, ko) — now 14 total
- Admin panel: 117 i18n keys, confirm modal, animated tabs, no inline handlers
- Profile page: 58 i18n keys with data-i18n attributes
- Fix i18n safeT() shadowing bug and translationsLoaded timing
- Fix grid/list view: list header no longer shows in grid mode on login
- Fix classList.toggle hidden sync for view switching across all nav functions
- Revert .hidden important that broke login page rendering
- Add files empty state (no_files + empty_hint) with translations
- Fix language selector dropdown scroll and styling
- Fix admin panel scroll with sticky tabs
2026-03-09 00:08:34 +01:00
f2d35ca792
feat: auto-persist JWT secret, remove setup token requirement
...
- JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret
- Remove setup token: first admin setup is open until system initialized
- Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top
- Update login UI and auth.js to remove setup token fields
2026-03-05 22:12:53 +01:00
b503e08384
security: fix vulnerabilities 1-7 from security audit
...
- Fix #1 : Share handler IDOR - enforce owner check on share operations
- Fix #2 : list_files_query IDOR - bind folder queries to authenticated user
- Fix #3 : Dedup handler IDOR - restrict dedup operations to file owner
- Fix #4 : Trash handler OptionalAuthUser - require full AuthUser
- Fix #5 : Error info leakage - sanitize 500 error responses
- Fix #6 : Chunked upload IDOR - bind upload sessions to user_id,
add verify_session_owner() check on all session operations
- Fix #7 : CSP unsafe-inline removal - migrate all inline scripts,
styles and event handlers to external files, tighten CSP to
script-src 'self'; style-src 'self'
New files:
- static/js/core/theme-init.js (render-blocking theme init)
- static/js/core/sw-register.js (service worker registration)
- static/css/views/device-verify.css (extracted inline styles)
- static/js/views/device-verify/device-verify.js (extracted inline script)
2026-03-05 13:15:34 +01:00
269a5fe940
feat: implement full breadcrumb path navigation in Files tab
...
- Add breadcrumbPath array to app state for tracking folder hierarchy
- Rewrite updateBreadcrumb() to render full path: Home > folder > subfolder
- Each breadcrumb segment is clickable to navigate back to that level
- Current folder shown in bold (non-clickable), parent folders as links
- Reset breadcrumb path on tab switch, home navigation, and initial load
- Update navigateFolder/selectFolder to push to breadcrumb path
- Enhanced breadcrumb CSS with hover effects and dark mode support
2026-02-21 00:19:04 +01:00
Diocrafts