ancsemi
415ff761e4
v1.2.0: comprehensive bug hunt + voice UX + pinning + link previews + GIF search
...
Security fixes:
- Admin username hijack via rename (critical)
- XSS via unescaped quotes in _escapeHtml (critical)
- SSRF protection on /api/link-preview
- API key leak in get-server-settings to non-admins
- Cross-channel reaction removal without verification
- Voice signaling (offer/answer/ICE) without room membership check
- Typing indicator without channel membership check
Bug fixes:
- Voice audio: single MediaStreamSource splits to analyser + gain
- Talking indicator: 300ms hysteresis for smooth detection
- Screen share: SDP rollback, event.streams[0], track.onunmute
- GIF send broken: wrong property names silently dropped all GIFs
- Reconnect recovery: re-emit channel/state events on socket reconnect
- Screen share privacy: stopScreenShare() on viewer close
- Auto-scroll: force flag after message append
- Delete-user FK violation: clean up all related tables
- Delete-channel: remove associated pinned_messages
- Delete-message: remove associated pinned_messages
- LIKE wildcard injection in search-messages
Performance:
- N+1 query in get-messages replaced with 3 batch queries
Features (from prior uncommitted work):
- Voice join/leave audio cues, talking indicators
- Multi-stream screen sharing with tiled grid
- Message pinning (admin-only, 50/channel cap)
- Enhanced markdown: fenced code blocks, blockquotes
- Link previews with OG metadata + 30min cache
- Tenor GIF search with admin-configurable API key
Docs:
- README updated with new features, voice/screen share docs
- CHANGELOG v1.2.0 entry with full details
- Version bumped to 1.2.0
2026-02-11 20:33:29 -05:00
ancsemi
5a11a910b3
feat: move all user data to external directory (%APPDATA%\Haven or ~/.haven)
...
- Database, .env, certs, and uploads now stored outside the code directory
- Auto-migration moves existing data from old locations on first launch
- SSL certs auto-detected in data dir (no .env config needed)
- New src/paths.js module as single source of truth for all data paths
- HAVEN_DATA_DIR env var for custom data location override
- Updated Start Haven.bat, start.sh, README, GUIDE, .env.example
- Bumped version to 1.1.0
2026-02-11 16:52:46 -05:00
ancsemi