ScreenTinker 470197d203 Fix 8 security findings from Phase 3 audit + device-detail banner refresh ... Security fixes: - Critical: Add ownership checks to assignments PUT/:id and DELETE/:id (IDOR) - Critical: Add ownership checks to assignments copy-to endpoint for both devices - High: Validate device ownership when adding to device groups - High: UUID-validate content ID before LIKE query + scope to owner's playlists - Low: Handle FK violations gracefully in playlist discard (deleted content/widgets) - Low: Escape mime_type with esc() in playlist item display (XSS) Bug fix: - Device-detail mutation handlers now reload full page to show draft banner Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>		2026-04-13 21:36:16 -05:00
..
components	Initial open source release	2026-04-08 12:14:53 -05:00
views	Fix 8 security findings from Phase 3 audit + device-detail banner refresh	2026-04-13 21:36:16 -05:00
api.js	Phase 3: playlist publish/draft state with auto-publish from device detail	2026-04-13 20:52:29 -05:00
app.js	Add playlists route to frontend app.js router	2026-04-11 21:16:08 -05:00
i18n.js	Initial open source release	2026-04-08 12:14:53 -05:00
socket.js	Initial open source release	2026-04-08 12:14:53 -05:00
utils.js	Security audit remediation: auth, IDOR, XSS, hardening	2026-04-11 22:48:07 -05:00