Block a user
wtclaude
created branch fix/username-validation-update in RunicGateway/website
2026-07-03 02:38:25 +00:00
Re-validate JWT against the DB in isLoggedIn (fixes #12)
Enforce role-based authorization on admin-only routes (fixes #10)
wtclaude
created branch fix/stale-jwt-revalidation in RunicGateway/website
2026-07-03 02:19:22 +00:00
[Bug][Medium]
username unvalidated and not uniqueness-checked on user update
[Bug][Medium] Server boots with no
JWT_SECRET (only a warning)
[Security][High] Uploaded file extension is attacker-controlled → stored XSS
[Security][Medium] Stale JWT: demoted/deleted users keep access until token expiry
[Security][High] No role-based authorization —
editor role is never enforced
Fix #6: larger RTE toolbar buttons + bigger, both-axis-scrolling editor
RTE Posts upgrade: TipTap rich-text editing + sanitization for posts