fen - Gitea: Git with a cup of tea

fen merged pull request poslop/palette#290

2026-09-18 01:48:43 +00:00

Sync main into dev (owner README edit #279)

fen pushed to dev-main-sync at poslop/palette

2026-09-18 01:47:13 +00:00

1149989d07 Merge pull request 'Release v0.5.0: dev -> main' (#288) from dev into main

fen created branch dev-main-sync in poslop/palette

2026-09-18 01:47:12 +00:00

fen created pull request poslop/palette#290

2026-09-18 01:47:11 +00:00

Sync main into dev (owner README edit #279)

fen created pull request poslop/palette#289

2026-09-18 01:46:25 +00:00

Fix #280 follow-up: remove PALETTE_TRUSTED_IP_HEADER

fen pushed to fix-280 at poslop/palette

2026-09-18 01:46:09 +00:00

b99e1bdb27 Fix #280 follow-up: remove PALETTE_TRUSTED_IP_HEADER

fen created branch fix-280 in poslop/palette

2026-09-18 01:46:09 +00:00

fen created pull request poslop/palette#288

2026-09-18 01:43:42 +00:00

Release v0.5.0: dev -> main

fen commented on pull request poslop/palette#287

2026-09-18 01:40:42 +00:00

HIGH #280: rate limiter bypassable via X-Forwarded-For

Closing as superseded. PR #284 (same scope: rate-limit buckets keyed on peer address instead of client-controlled XFF) was merged to dev (eca8533) and verified live on palette-dev with the…

fen deleted branch fix-282 from poslop/palette

2026-09-18 01:38:36 +00:00

fen commented on issue poslop/palette#282

2026-09-18 01:38:36 +00:00

MEDIUM: jump-to-top/bottom nav hidden on mobile until a resize event

QA PASS (attempt 1). PR #285 merged into dev (ed435c5), CI green (test + docker), deployed to palette-dev. Evidence: served /static/jump.js sha256 3c68b42d... matches origin/dev tip. Rendered…

fen deleted branch fix-281 from poslop/palette

2026-09-18 01:37:53 +00:00

fen commented on issue poslop/palette#280

2026-09-18 01:37:51 +00:00

HIGH: rate limiter bypassable via X-Forwarded-For

Note: a competing un-PR'd implementation (commit a0b3437 on fix-280, trusted-proxies + PALETTE_CLIENT_IP_HEADER design, pushed 01:34 UTC) was superseded by merged PR #284; its branch was deleted…

fen closed issue poslop/palette#281

2026-09-18 01:37:51 +00:00

MEDIUM: /raw/{id} returns empty body for non-image attachment pastes

fen commented on issue poslop/palette#281

2026-09-18 01:37:51 +00:00

MEDIUM: /raw/{id} returns empty body for non-image attachment pastes

QA PASS (fix attempt 1). Merged PR #286 and deployed to palette-dev.

Evidence (live, post-rollout):

text/plain attachment: GET /raw/ddngmc -> 200, Content-Type "text/plain; charset=utf-8", 42…

fen closed pull request poslop/palette#287

2026-09-18 01:37:12 +00:00

HIGH #280: rate limiter bypassable via X-Forwarded-For

fen deleted branch fix-280 from poslop/palette

2026-09-18 01:37:12 +00:00

fen reopened issue poslop/palette#280

2026-09-18 01:36:35 +00:00

HIGH: rate limiter bypassable via X-Forwarded-For

fen commented on issue poslop/palette#280

2026-09-18 01:36:24 +00:00

HIGH: rate limiter bypassable via X-Forwarded-For

QA pass on PR #284 (merged to dev eca8533, deployed to palette-dev). Merged under OWNER REVIEW, not closed: one wiring gap.

Verified live on palette-dev (fix deployed, CI docker green): -…

fen pushed to fix-280 at poslop/palette

2026-09-18 01:35:21 +00:00

a0b34378a4 fix #280: key rate-limit buckets on peer address, not client XFF