popertots
b4d91d5dc0
Security pass
2026-02-20 12:59:10 +00:00
popertots
a5a2ffd83e
Security: add rate limiting, input validation, and filter category
...
validation
Backend:
- Add rate limiting middleware (mw/ratelimit.go) - in-memory per-IP
limiter
- Apply rate limits per endpoint group:
- Public read-only: 120/min
- Registration: 10/min
- Portfolio filters: 60/min
- Authenticated users: 120/min
- Admin: none (trusted)
- Add 256 char input length validation on portfolio endpoints
- Validate filter categories exist in DB before querying
- Secure GetImage endpoint: only allow UUID or numeric timestamp (15-20
digits)
- Remove pattern-based image lookup to prevent enumeration
- Add services validation: name (100), duration (1-480), patch test
(0-168)
Frontend:
- Add maxlength=256 to portfolio tag/search inputs
- Add maxlength to registration: name (50), email (255), phone (20),
password (72)
- Add maxlength=100 to service name input
2026-02-20 12:03:14 +00:00
popertots
9259de9393
Portfolio: add filtering, URL sharing, and improved tag input
...
- Add category filters with dynamic counts that reduce as filters
applied
- Add ?filter[category]=value URL params for filterable links
- Add ?img= timestamp param that bypasses filters to show specific image
- Update URL when opening/navigating/closing modal for shareable links
- Backend: add /api/portfolio/filters endpoint with filter logic
- Backend: add timestamp lookup fallback for GetImage endpoint
Frontend:
- Portfolio page: filter dropdowns, keyboard nav, mobile improvements
- ImageUpload: live tag suggestions from API, arrow/Tab navigation,
confirmation modal before upload, mobile-optimized touch targets
- Add scrollbar-hide utility and fix filter dropdown overflow
- Move Clear all button, add vertical separator on desktop
2026-02-20 00:32:09 +00:00
popertots
d43d7ebc5e
readme
2026-02-17 22:38:22 +00:00
popertots
e20263b717
Update readme
2026-02-17 21:47:11 +00:00
popertots
50746595e7
feat(bookings): improve admin booking wizard and user dashboard
...
Backend:
- Enriched GetAllUserBookings response with calculated total_amount,
amount_paid, and duration_minutes.
- Refactored GetBookingHandler to return a flat booking object matching
frontend expectations.
- Added account_role to admin user list response and sorted users by
booking activity.
- Corrected function name oo to AdminCreateBookingForUserHandler.
Frontend:
- Rebuilt BookingCreateModal into a 4-step wizard supporting guest
bookings, service overrides, and real-time availability checks.
- Fixed account dashboard logic to correctly identify upcoming vs past
bookings and sort unpaid items to the top.
- Extracted booking flow into a shared BookingFlow component.
- Redirected admin users from home page to /today.
2026-02-12 22:15:10 +00:00
popertots
28815d3b25
Update readme
2025-11-06 16:05:33 +00:00
popertots
f1dc375c5f
update obsidian
2025-11-03 23:47:58 +00:00
popertots
2b7ec96d37
obsidian 1
2025-11-03 23:25:04 +00:00
popertots