33ccfd373a
Merge pull request 'Fix invisible select chevron in all presets (#136)' (#151) from fix-136-select-chevron into dev
d44e4d1587
Merge pull request 'Secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141)' (#150) from fix-137-141-drop-query-secrets into dev
QA passed. Verified on live palette-dev (build 33ccfd3): CSP header includes img-src 'self' data:; select chevron renders with themed stroke in midnight (light #C8C8D4) and smooth (dark #555560)…
QA passed (verified against live palette-dev after PR #151 deploy). Line wrap toggle present on /new and paste viewer, styled as topbar icon; aria-pressed defaults false, click flips white-space…
33ccfd373a
Merge pull request 'Fix invisible select chevron in all presets (#136)' (#151) from fix-136-select-chevron into dev
Fix proposal: key the rate limiter on a client-supplied identity where available (viewer cookie or authenticated token) with IP as fallback, so users behind shared egress IPs are not collectively…
Fix proposal: accept the deletion token only in the X-Deletion-Token header (and in the POST body of the UI flow), remove the ?token= query path, and redirect-strip tokens from URLs. One-file…
Fix proposal (trivial CSS): add overflow-wrap:anywhere / word-break:break-word to the paste title h1 (and clamp to two lines with -webkit-line-clamp) so long unbroken titles wrap instead of…
Fix proposal: move the small inline boot script into /static/app.js and restrict script-src to self (drop unsafe-inline). style-src unsafe-inline is still needed for the runtime-generated theme…
Fix proposal (trivial): set the Secure attribute on the vwr viewer cookie (the dev site is HTTPS-only behind Traefik; keep SameSite=Lax). One-line change in the cookie-setting helper.
d44e4d1587
Merge pull request 'Secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141)' (#150) from fix-137-141-drop-query-secrets into dev