immich-folio

Koko210/immich-folio

Fork 0

Commit Graph

Author	SHA1	Message	Date
ralksta	6c20218369	security: fix XSS in map popups, refactor HeroTextContent, add evict test - escapeHtml() in MapView.tsx sanitises city/country/url/name before HTML injection - HeroTextContent extracted to top-level component with explicit props (was nested inside async Server Component) - rate-limit.test.ts: add evictIfFull stress test (6/6 pass)	2026-03-13 12:52:09 +01:00
ralksta	a0ee0ff433	chore: production readiness audit - Move plans/ to dev-docs/, delete unused scaffold SVGs - Create .dockerignore, rename container to immich-folio - Extract BackLink component and toPhotoItems() helper in page.tsx - Add keyboard accessibility (role=button, tabIndex, onKeyDown) to PhotoGrid - Add aria-label to Lightbox EXIF toggle - Fix React lint: replace setState-in-effect with useState initializer - Add rate limiting to /api/auth (brute-force protection, 10 RPM) - Add HSTS and X-DNS-Prefetch-Control security headers - Add Secure flag to auth cookie in production - New unit tests: rate-limit.test.ts (5), auth.test.ts (12) - All 47 tests pass, 0 lint errors, build clean	2026-02-15 11:23:51 +01:00

Author

SHA1

Message

Date

ralksta

6c20218369

security: fix XSS in map popups, refactor HeroTextContent, add evict test

- escapeHtml() in MapView.tsx sanitises city/country/url/name before HTML injection
- HeroTextContent extracted to top-level component with explicit props (was nested inside async Server Component)
- rate-limit.test.ts: add evictIfFull stress test (6/6 pass)

2026-03-13 12:52:09 +01:00

ralksta

a0ee0ff433

chore: production readiness audit

- Move plans/ to dev-docs/, delete unused scaffold SVGs
- Create .dockerignore, rename container to immich-folio
- Extract BackLink component and toPhotoItems() helper in page.tsx
- Add keyboard accessibility (role=button, tabIndex, onKeyDown) to PhotoGrid
- Add aria-label to Lightbox EXIF toggle
- Fix React lint: replace setState-in-effect with useState initializer
- Add rate limiting to /api/auth (brute-force protection, 10 RPM)
- Add HSTS and X-DNS-Prefetch-Control security headers
- Add Secure flag to auth cookie in production
- New unit tests: rate-limit.test.ts (5), auth.test.ts (12)
- All 47 tests pass, 0 lint errors, build clean

2026-02-15 11:23:51 +01:00

2 Commits