3 commits

Author	SHA1	Message	Date
ScreenTinker	7a17bb5079	i18n batch 5: wire layout-editor + video-wall + billing (~85 keys) ... - layout-editor.js: list with templates + custom, zone editor with drag/resize and properties panel - video-wall.js: list with grid preview, editor with grid config, bezel inputs, drag-and-drop device placement - billing.js: current plan card, plans grid with checkout buttons, Stripe portal integration - 943 keys total, parity 100% across en/es/fr/de/pt Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-29 20:13:38 -05:00
ScreenTinker	afbe113acf	Security audit remediation: auth, IDOR, XSS, hardening ... - Device WebSocket authentication: devices get a device_token on registration, must present it on reconnect. All WS events require prior auth. Timing-safe token comparison. - IDOR fixes: ownership checks on schedules (device, week), layouts (all CRUD, zones, duplicate, device assign), video-walls (content, device-config). - XSS prevention: shared esc() helper in utils.js, fixed 13 innerHTML injection points across 9 frontend files. - OAuth hardening: no longer silently overwrites auth_provider on accounts with local passwords (returns 409). - JWT pinned to HS256 for sign and verify. - Password policy: change endpoint now requires 8 chars (was 6). - HSTS header enabled (max-age 1 year, includeSubDomains). - Stripe webhook rejects unsigned payloads when no secret configured. - Screenshot size validation (max 2MB base64). - Rate limiting on exports, imports, content operations. - Content file serving checks playlist_items instead of old assignments. - Content ownership verified in device-groups assign-content. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-11 22:48:07 -05:00
ScreenTinker	1594a9d4a4	Initial open source release ... ScreenTinker - open source digital signage management software. MIT License, all features included, no license gates. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-08 12:14:53 -05:00