ScreenTinker 766f02ae5d docs(upload): correct misleading defParamCharset comment ... The previous comment claimed defParamCharset:'utf8' fixed multipart filename header decoding. It doesn't - that option only fires for the RFC 5987 encoded filename*=utf-8''... form, which clients rarely send. The actual UTF-8 recovery happens in the storage.filename callback (added in d679ca8) via Buffer.from(name,'latin1').toString('utf8'). The option is kept set for the rare RFC 5987 case but the comment no longer overclaims what it does.		2026-05-12 11:57:54 -05:00
..
config	fix: log real client IPs through Cloudflare instead of CF edge	2026-05-07 15:26:37 -05:00
db	fix(boot): auto-apply Phase 1 multi-tenancy migration on startup if not yet applied; refactor scripts/migrate-multitenancy.js to expose runMigration() with CLI wrapper preserved; pre-migration snapshot to db/remote_display.pre-migration-<timestamp>.db; belt-and-suspenders guards on migrateFolderWorkspaceIds + backfillActivityLogWorkspace so the inline backfills skip cleanly if workspaces table absent. Fixes startup crash on pre-multi-tenancy installs (semetra22 / Discord report) where 'npm start' after pulling latest hit migrateFolderWorkspaceIds and crashed with 'no such table: workspaces'. Self-hosters now get an automatic upgrade path without needing to run 'node scripts/migrate-multitenancy.js' manually.	2026-05-12 08:22:47 -05:00
lib	feat(socket): Phase 2.3 workspace-scoped dashboard socket rooms + per-command permission gates. Dashboard namespace was previously a flat broadcast - every connected dashboard received every device's status/screenshot/playback events platform-wide (foreign device names + IPs included). Inbound socket commands gated by a legacy admin/superadmin role check that was dead code post-Phase-1 rename.	2026-05-12 11:34:24 -05:00
middleware	docs(upload): correct misleading defParamCharset comment	2026-05-12 11:57:54 -05:00
player	Video walls: free-form canvas editor, leader-driven sync, group dissolve, progress bars	2026-04-29 23:11:16 -05:00
routes	fix(server): NFC normalize user-facing filenames in safeFilename	2026-05-12 11:51:34 -05:00
services	feat(socket): Phase 2.3 workspace-scoped dashboard socket rooms + per-command permission gates. Dashboard namespace was previously a flat broadcast - every connected dashboard received every device's status/screenshot/playback events platform-wide (foreign device names + IPs included). Inbound socket commands gated by a legacy admin/superadmin role check that was dead code post-Phase-1 rename.	2026-05-12 11:34:24 -05:00
ws	feat(socket): Phase 2.3 workspace-scoped dashboard socket rooms + per-command permission gates. Dashboard namespace was previously a flat broadcast - every connected dashboard received every device's status/screenshot/playback events platform-wide (foreign device names + IPs included). Inbound socket commands gated by a legacy admin/superadmin role check that was dead code post-Phase-1 rename.	2026-05-12 11:34:24 -05:00
config.js	Add DISABLE_REGISTRATION env var to block public sign-ups	2026-04-22 19:35:32 -05:00
package-lock.json	Security: fix IDORs, XSS, rate limits, SSRF validation	2026-04-28 14:37:18 -05:00
package.json	Security: fix IDORs, XSS, rate limits, SSRF validation	2026-04-28 14:37:18 -05:00
server.js	feat(socket): Phase 2.3 workspace-scoped dashboard socket rooms + per-command permission gates. Dashboard namespace was previously a flat broadcast - every connected dashboard received every device's status/screenshot/playback events platform-wide (foreign device names + IPs included). Inbound socket commands gated by a legacy admin/superadmin role check that was dead code post-Phase-1 rename.	2026-05-12 11:34:24 -05:00