5 Commits

Author	SHA1	Message	Date
ralksta	6c20218369	security: fix XSS in map popups, refactor HeroTextContent, add evict test ... - escapeHtml() in MapView.tsx sanitises city/country/url/name before HTML injection - HeroTextContent extracted to top-level component with explicit props (was nested inside async Server Component) - rate-limit.test.ts: add evictIfFull stress test (6/6 pass)	2026-03-13 12:52:09 +01:00
ralksta	c610ad2a7d	fix(map): show HTTP status code in error message for easier debugging	2026-03-13 12:31:21 +01:00
ralksta	e394fe84a0	security: implement AUTH_SECRET and secure map/exif API routes	2026-03-07 08:18:23 +01:00
ralksta	76889093bf	fix: prevent Leaflet tile rendering on hidden container ... Keep map container always visible (no display:none), overlay loading text on top, and call invalidateSize() after init.	2026-02-15 23:14:08 +01:00
ralksta	62a7b178d6	feat: add smart map view with location-level clustering ... - /map page with Leaflet (CartoDB dark tiles) - Photos clustered by city/country (not per-photo) - /api/map endpoint with encrypted cover asset IDs - Configurable via gallery.yaml (map: true/false) - Conditional nav link in header - CSP updated for Leaflet CDN and tile servers - Theme-aware popups with cover thumbnails and album links	2026-02-15 23:07:04 +01:00