mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-09-25 03:42:06 +00:00
xarmian
a3d0b02d23
* fix(web): don't mask/redirect on 401 from auth-form submissions (BUG-1929) The client's global 401 interceptor hard-redirected to /login and threw a hardcoded "Authentication required" message for every 401, including bad-credentials responses from login, register, and 2FA verification — masking the server's real error and stranding invitees mid-join. Auth-form 401s now surface the server's message inline instead; session-expiry 401s elsewhere are unchanged except that the redirect now preserves a ?redirect= return-to path. * test(web): pin hostile ?redirect= values as rejected (BUG-1929 follow-up) Codex R2 found no live browser-exploitable bypass in validateRedirect, but two of the five hostile forms it checked (percent-encoded slash/ backslash, e.g. /%2Fhost) passed through unrejected today — not exploitable via normal navigation, but a validator gap nonetheless. Reject percent-encoded slash/backslash defensively and add unit pins for all five hostile shapes so a future regression here can't be silent.