2 Commits

Author SHA1 Message Date
UNITRONIX 4c9a1f632e fix(security): phase-D Go API ID guards across all proxy routes
Extend assertSafeApiId to organizations, resource-control, permissions,
tokens, and update paths; harden org UI XSS and attachment confinement.
2026-06-09 03:13:53 +02:00
UNITRONIX 97492d6005 fix(security): validate Go API paths and file browser entries
Add goApiPath guard on betterdeskApi axios requests, sanitize org/device
IDs in policy routes, and confine server-management directory listings
with resolveChildPath.
2026-06-09 02:46:22 +02:00