7 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
fen	70c284b15d	Fix #120: add matching light/dark variant for every theme	2026-09-09 21:33:56 -05:00
fen	a677e627a8	Fix #114: use presetColors(t.id) for theme card swatches ... t.colors was removed by #113; rendering threw on first iteration and the theme grid rendered empty. Use the colors returned by presetColors(t.id) instead. Verified in headless chromium: 5 theme-card elements render on /settings.	2026-09-09 20:55:13 -05:00
fen	6b95994c53	Admin lock on every load, drop settings hint, derive theme swatches from CSS vars (#112)	2026-09-09 19:52:32 -05:00
fen	df73d56e32	Merge remote-tracking branch 'origin/fix-93-version-label' into dev	2026-09-09 18:41:26 -05:00
fen	389e4d333f	Bound title and language at create time (#86) ... Titles are trimmed and truncated to 200 characters; language must be blank or match ^[a-zA-Z0-9+#-]{1,40}$ (max 40 chars) or the create is rejected with a clear 400. Regression tests cover truncation, malformed and oversized language values, valid identifiers, and blank metadata.	2026-09-09 10:58:34 -05:00
fen	99a044e8a2	Rate-limit all password verification attempts (#81) ... GET ?password= and X-Paste-Password header checks in handleGetPaste were unlimited (pentest2: 8 wrong = 8x401, no 429). Gate every password verification on the same per-IP+paste unlock limiter (5/min, 429 with Retry-After) already used by the POST unlock form path. Regression tests: repeated wrong passwords via GET ?password= and via header must eventually 429; correct password within burst still 200. Fixes #81	2026-09-09 10:58:21 -05:00
fen	bb5c4f0186	fix #60: apply ValidExpiry clamp to cans create handler (was lost in working tree)	2026-09-09 09:15:39 -05:00