root
17ab5f0390
- /auth/register: strip client-supplied seed flag (PoC confirmed it bypassed invite code, MAX_USERS quota AND first-user auto-admin, granting admin without any credential); demo-rebuild internal path unaffected - /auth/login: per-IP+username of 5 consecutive failures gets a 10-minute cooldown against in-memory counter (brute-force guard) - /auth/logout: new endpoint revokes the current Bearer token server-side; frontend calls it (best-effort) before local clearToken on sidebar logout - attachment docx/xlsx preview: sanitize generated HTML (strip scripts, event handlers, dangerous protocols) before dangerouslySetInnerHTML render, preventing token theft via malicious previewed documents PoC suite: seed smuggling rejected, 429 on 6th login attempt, token dead after logout, per-user isolation intact (403/401/404 as before); integration 61/61 green
19 lines
704 B
HTML
19 lines
704 B
HTML
<!doctype html>
|
|
<html lang="zh-CN">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
|
|
<meta name="theme-color" content="#3056d3" />
|
|
<meta name="format-detection" content="telephone=no" />
|
|
<link rel="manifest" href="/manifest.webmanifest" />
|
|
<link rel="icon" href="/icons/pwa-192.png" />
|
|
<link rel="apple-touch-icon" href="/icons/pwa-192.png" />
|
|
<title>足迹 Footprints</title>
|
|
<script type="module" crossorigin src="/assets/index-DuP8O2p4.js"></script>
|
|
<link rel="stylesheet" crossorigin href="/assets/index-D9E2kUSE.css">
|
|
</head>
|
|
<body>
|
|
<div id="root"></div>
|
|
</body>
|
|
</html>
|