mirror of
https://github.com/screentinker/screentinker.git
synced 2026-05-15 07:32:23 -06:00
470197d203
Security fixes: - Critical: Add ownership checks to assignments PUT/:id and DELETE/:id (IDOR) - Critical: Add ownership checks to assignments copy-to endpoint for both devices - High: Validate device ownership when adding to device groups - High: UUID-validate content ID before LIKE query + scope to owner's playlists - Low: Handle FK violations gracefully in playlist discard (deleted content/widgets) - Low: Escape mime_type with esc() in playlist item display (XSS) Bug fix: - Device-detail mutation handlers now reload full page to show draft banner Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| activity.js | ||
| admin.js | ||
| billing.js | ||
| content-library.js | ||
| dashboard.js | ||
| designer.js | ||
| device-detail.js | ||
| help.js | ||
| kiosk.js | ||
| layout-editor.js | ||
| login.js | ||
| onboarding.js | ||
| playlists.js | ||
| reports.js | ||
| schedule.js | ||
| settings.js | ||
| teams.js | ||
| video-wall.js | ||
| widgets.js | ||