john-okeefe 420af7978a fix: critical security vulnerabilities ...

- Fix type assertion panics in auth.go (9 handlers)
  * GetProfile, UpdateProfile, UpdateTheme, UpdateUsername
  * UpdateEmail, UpdatePassword, DeleteAccount
  * UpdateScanSettings, GetScanSettings, Register admin check
  * Replace c.Get("user_id").(string) with MustGetAuthenticatedUser()

- Fix type assertion panic in library.go
  * GetUserVisibleLibraries now uses MustGetAuthenticatedUser()

- Add path traversal protection to AddLibraryFolder
  * Detect and block ".." in paths
  * Clean paths with filepath.Clean()
  * Verify path is a directory before adding

- Remove debug logging from Login handler
  * Removed all fmt.Printf statements
  * No more plaintext password logging

- Create safe context helper functions
  * internal/handlers/context.go added
  * GetAuthenticatedUser() for safe retrieval
  * MustGetAuthenticatedUser() for post-auth middleware

Security: Critical
Tests: All 62 integration tests pass
Breaking: None - backward compatible

2026-01-30 08:58:43 -05:00

..

auth.go

fix: critical security vulnerabilities

2026-01-30 08:58:43 -05:00

context.go

fix: critical security vulnerabilities

2026-01-30 08:58:43 -05:00

ebook.go

Phase 1: Add enhanced database fields and sorting

2026-01-30 08:32:49 -05:00

library.go

fix: critical security vulnerabilities

2026-01-30 08:58:43 -05:00

refresh_token.go

feat(middleware): add transaction and error handling support

2026-01-29 09:23:34 -05:00