2 Commits

Author	SHA1	Message	Date
Claude	e84835a0fb	Derive uploaded file extension from mimetype, not originalname (#11) ... The multer filename kept path.extname(file.originalname), while the fileFilter only checked the spoofable client-supplied mimetype. An attacker could send Content-Type: image/png with originalname x.html, landing an .html file in /uploads that express.static serves as text/html — same-origin stored XSS. - Store the extension from a whitelist keyed by the accepted mimetype (MIME_EXT), never from originalname. The fileFilter uses the same map as its single source of truth, so only mimetypes with a safe mapped extension pass. - Use crypto.randomBytes for the random filename component. - Serve /uploads with an explicit X-Content-Type-Options: nosniff (defense in depth alongside helmet's global setting). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 21:41:56 -05:00
whitlocktech	eef79e2403	Initial commit: UOMysticmoon backend (Express + MariaDB + JWT) ... - Layered API (router -> controller -> model -> db), serverlinkr pattern - Public / auth / admin route groups; posts, wiki, settings, users, activity models - JWT httpOnly-cookie auth (Secure auto-detected: LAN HTTP + Pangolin HTTPS) - Site LIVE/MAINTENANCE mode with admin preview bypass - Dual file+console logging (info/warn/error/debug) + HTTP access logs - Docker Compose (app + MariaDB), schema.sql + seed, .env.example - Verified end-to-end against MariaDB (27/27 smoke checks) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-26 20:58:32 -05:00