ScreenTinker d7e3ae6076 security(widgets): tighten webpage widget inner sandbox ... The webpage widget's inner iframe previously declared sandbox="allow-scripts allow-same-origin", which was functionally stripped to "allow-scripts" by the outer iframe sandbox added in fe36c8c. This commit makes the declared sandbox match the actual effective behavior. Closes the remaining piece of issue #8. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-05-30 13:14:31 -05:00
..
activity.js	Phase 2.1: tenancy middleware, permission helpers, JWT workspace context, frontend + backend role-rename compat	2026-05-11 20:02:00 -05:00
assignments.js	fix(zone-id): restore zone-aware playlist_items wiring (issue #3 follow-up)	2026-05-14 19:20:44 -05:00
auth.js	feat(workspaces): invite/accept-invite backend (slice 1+3)	2026-05-16 12:19:59 -05:00
contact.js	fix(landing): replace broken Custom pricing card with enterprise contact form	2026-05-14 13:52:24 -05:00
content.js	feat(socket): delivery queue for offline-device emits	2026-05-14 13:06:43 -05:00
device-groups.js	feat(socket): delivery queue for offline-device emits	2026-05-14 13:06:43 -05:00
devices.js	fix(zones): frontend assignment-flow picker + missed devices.js zone_id projection	2026-05-14 21:26:58 -05:00
folders.js	Phase 2.2c: content_folders gets workspace_id (schema + backfill); folders.js scoped; content.js folder-move strict same-workspace	2026-05-11 21:04:03 -05:00
kiosk.js	Phase 2.2e: kiosk.js scoped to workspace_id; import kiosk INSERT bundled	2026-05-11 21:20:18 -05:00
layouts.js	Phase 2.2h: layouts.js scoped to workspace_id; templates via is_template path; fixes pre-existing PUT /device/:deviceId cross-tenant layout-assignment leak	2026-05-11 21:45:28 -05:00
player-debug.js	Add player debug overlay and server-side error telemetry sink	2026-05-15 15:20:42 -05:00
playlists.js	fix(zone-id): restore zone-aware playlist_items wiring (issue #3 follow-up)	2026-05-14 19:20:44 -05:00
provisioning.js	Initial open source release	2026-04-08 12:14:53 -05:00
reports.js	Phase 2.2g: reports.js scoped to workspace_id; fixes pre-existing /export and /uptime cross-tenant leaks	2026-05-11 21:36:54 -05:00
schedules.js	Phase 2.2m: schedules.js scoped to workspace_id; schedule.workspace_id inherited from target (device/group); fixes 6 pre-existing cross-tenant leaks (POST content/widget/layout/playlist accepted with no check, PUT verifyOwnership rewrite across all 6 polymorphic targets)	2026-05-11 23:03:54 -05:00
status.js	Phase 2.2j: assignments.js scoped to workspace_id via playlist.workspace_id; fixes 3 pre-existing cross-tenant leaks (content add, widget add with NO existing check, copy-to cross-workspace); ensureDevicePlaylist loop-closer; status.js playlist INSERT bundle	2026-05-11 22:12:13 -05:00
stripe.js	Security audit remediation: auth, IDOR, XSS, hardening	2026-04-11 22:48:07 -05:00
subscription.js	Initial open source release	2026-04-08 12:14:53 -05:00
teams.js	feat(teams): temporarily disable Teams API while feature is redesigned	2026-05-12 13:30:55 -05:00
video-walls.js	feat(socket): delivery queue for offline-device emits	2026-05-14 13:06:43 -05:00
white-label.js	Phase 2.2f: white-label.js scoped to workspace_id; requireWorkspaceAdmin gate; status.js bundle	2026-05-11 21:30:22 -05:00
widgets.js	security(widgets): tighten webpage widget inner sandbox	2026-05-30 13:14:31 -05:00
workspaces.js	fix(workspaces): use APP_URL env var for invite-accept URL generation	2026-05-17 15:26:07 -05:00