root
17ab5f0390
- /auth/register: strip client-supplied seed flag (PoC confirmed it bypassed invite code, MAX_USERS quota AND first-user auto-admin, granting admin without any credential); demo-rebuild internal path unaffected - /auth/login: per-IP+username of 5 consecutive failures gets a 10-minute cooldown against in-memory counter (brute-force guard) - /auth/logout: new endpoint revokes the current Bearer token server-side; frontend calls it (best-effort) before local clearToken on sidebar logout - attachment docx/xlsx preview: sanitize generated HTML (strip scripts, event handlers, dangerous protocols) before dangerouslySetInnerHTML render, preventing token theft via malicious previewed documents PoC suite: seed smuggling rejected, 429 on 6th login attempt, token dead after logout, per-user isolation intact (403/401/404 as before); integration 61/61 green
2 lines
822 B
JavaScript
2 lines
822 B
JavaScript
import{r}from"./index-DuP8O2p4.js";import{g as f}from"./echarts-BIWefrIc.js";function p(){const[n,o]=r.useState(0);return r.useEffect(()=>{const s=()=>o(t=>t+1);return window.addEventListener("fp-theme-change",s),()=>window.removeEventListener("fp-theme-change",s)},[]),n}function d(n){return getComputedStyle(document.documentElement).getPropertyValue("--text-"+n).trim()||"#454e5c"}function h(n,o){const s=r.useRef(null),[t,i]=r.useState(null),u=r.useRef(n);return u.current=n,r.useEffect(()=>{if(!t)return;const e=f(t);s.current=e,e.setOption(u.current(),{notMerge:!0});const c=new ResizeObserver(()=>e.resize());return c.observe(t),()=>{c.disconnect(),e.dispose(),s.current=null}},[t]),r.useEffect(()=>{var e;(e=s.current)==null||e.setOption(u.current(),{notMerge:!0})},[t,...o]),e=>i(e)}export{h as a,d as i,p as u};
|