palette

10 Commits

Author	SHA1	Message	Date
fen	f1b5dd0364	Merge pull request 'Remove custom URL reservation note and Can contents menu' (#126 ) from fix-124-remove-note-can-menu into dev CI / test (push) Successful in 25s Details CI / docker (push) Successful in 40s Details	2026-09-09 22:05:05 -05:00
fen	8eabeb4839	Merge dev into fix-124: resolve new.html conflict, keep #124 removals and #125 placeholder CI / test (pull_request) Successful in 25s Details CI / docker (pull_request) Skipped Details	2026-09-09 21:53:00 -05:00
fen	1e317d11da	UI polish: placeholder slash, styled controls, admin link spacing (#123 ) CI / test (pull_request) Successful in 24s Details CI / docker (pull_request) Skipped Details	2026-09-09 21:45:22 -05:00
fen	70c284b15d	Fix #120 : add matching light/dark variant for every theme CI / test (pull_request) Successful in 31s Details CI / docker (pull_request) Skipped Details	2026-09-09 21:33:56 -05:00
fen	a677e627a8	Fix #114 : use presetColors(t.id) for theme card swatches CI / test (pull_request) Successful in 24s Details CI / docker (pull_request) Skipped Details t.colors was removed by #113; rendering threw on first iteration and the theme grid rendered empty. Use the colors returned by presetColors(t.id) instead. Verified in headless chromium: 5 theme-card elements render on /settings.	2026-09-09 20:55:13 -05:00
fen	6b95994c53	Admin lock on every load, drop settings hint, derive theme swatches from CSS vars (#112 ) CI / test (pull_request) Successful in 24s Details CI / docker (pull_request) Skipped Details	2026-09-09 19:52:32 -05:00
fen	df73d56e32	Merge remote-tracking branch 'origin/fix-93-version-label' into dev CI / test (push) Successful in 28s Details CI / docker (push) Successful in 49s Details	2026-09-09 18:41:26 -05:00
fen	389e4d333f	Bound title and language at create time (#86 ) CI / test (pull_request) Successful in 21s Details CI / docker (pull_request) Skipped Details Titles are trimmed and truncated to 200 characters; language must be blank or match ^[a-zA-Z0-9+#-]{1,40}$ (max 40 chars) or the create is rejected with a clear 400. Regression tests cover truncation, malformed and oversized language values, valid identifiers, and blank metadata.	2026-09-09 10:58:34 -05:00
fen	99a044e8a2	Rate-limit all password verification attempts (#81 ) CI / test (pull_request) Successful in 22s Details CI / docker (pull_request) Skipped Details GET ?password= and X-Paste-Password header checks in handleGetPaste were unlimited (pentest2: 8 wrong = 8x401, no 429). Gate every password verification on the same per-IP+paste unlock limiter (5/min, 429 with Retry-After) already used by the POST unlock form path. Regression tests: repeated wrong passwords via GET ?password= and via header must eventually 429; correct password within burst still 200. Fixes #81	2026-09-09 10:58:21 -05:00
fen	bb5c4f0186	fix #60 : apply ValidExpiry clamp to cans create handler (was lost in working tree) CI / test (pull_request) Successful in 27s Details CI / docker (pull_request) Skipped Details	2026-09-09 09:15:39 -05:00