 ancsemi
|
a3f75d3720
|
v2.2.5 Remove desktop app, security fixes, bug fixes
- Remove desktop/ directory and all desktop-grafted code from server
- Fix missing express-rate-limit import (server crash on startup)
- Validate webhook avatar_url protocol (block data: URI tracking)
- FORCE_HTTP support for reverse proxies (#48)
- Auto-assign default roles (#14)
- SSRF bypass prevention in link previews
- JWT admin claim verification from DB (13 endpoints)
- Path traversal fix in avatar uploads
- mark-read membership check
- transfer-admin race condition mutex
- Server-side sanitizeText() defense-in-depth
- broadcastChannelLists debounce (DoS fix)
- reorder-channels capped at 500
- Role color XSS prevention (server + client)
- Screen share quality controls, black screen fixes
- SSL setup script, cross-platform gameplan doc
- Website & docs updated to v2.2.5
|
2026-02-23 21:52:38 -05:00 |
|