mirror of
https://github.com/ancsemi/Haven.git
synced 2026-11-04 21:12:50 +00:00
ancsemi
415ff761e4
Security fixes: - Admin username hijack via rename (critical) - XSS via unescaped quotes in _escapeHtml (critical) - SSRF protection on /api/link-preview - API key leak in get-server-settings to non-admins - Cross-channel reaction removal without verification - Voice signaling (offer/answer/ICE) without room membership check - Typing indicator without channel membership check Bug fixes: - Voice audio: single MediaStreamSource splits to analyser + gain - Talking indicator: 300ms hysteresis for smooth detection - Screen share: SDP rollback, event.streams[0], track.onunmute - GIF send broken: wrong property names silently dropped all GIFs - Reconnect recovery: re-emit channel/state events on socket reconnect - Screen share privacy: stopScreenShare() on viewer close - Auto-scroll: force flag after message append - Delete-user FK violation: clean up all related tables - Delete-channel: remove associated pinned_messages - Delete-message: remove associated pinned_messages - LIKE wildcard injection in search-messages Performance: - N+1 query in get-messages replaced with 3 batch queries Features (from prior uncommitted work): - Voice join/leave audio cues, talking indicators - Multi-stream screen sharing with tiled grid - Message pinning (admin-only, 50/channel cap) - Enhanced markdown: fenced code blocks, blockquotes - Link previews with OG metadata + 30min cache - Tenor GIF search with admin-configurable API key Docs: - README updated with new features, voice/screen share docs - CHANGELOG v1.2.0 entry with full details - Version bumped to 1.2.0
22 lines
486 B
JSON
22 lines
486 B
JSON
{
|
|
"name": "haven",
|
|
"version": "1.2.0",
|
|
"description": "Self-hosted private chat — your server, your rules",
|
|
"license": "MIT",
|
|
"main": "server.js",
|
|
"scripts": {
|
|
"start": "node server.js",
|
|
"dev": "node --watch server.js"
|
|
},
|
|
"dependencies": {
|
|
"bcryptjs": "^2.4.3",
|
|
"better-sqlite3": "^11.7.0",
|
|
"dotenv": "^16.4.7",
|
|
"express": "^4.21.2",
|
|
"helmet": "^8.1.0",
|
|
"jsonwebtoken": "^9.0.2",
|
|
"multer": "^2.0.2",
|
|
"socket.io": "^4.8.1"
|
|
}
|
|
}
|