pediatric-ai-scribe-v3

danvics/pediatric-ai-scribe-v3

Fork 0

Commit graph

Author	SHA1	Message	Date
Daniel Onyejesi	7c7f72f54a	Fix WebDAV selection, pdf-parse, prompt(), CSP, security issues 1/2/4/5 pdf-parse (was v2, broken API): - Downgraded to v1.1.1 — default export is a function again - pdfParse is not a function error fixed WebDAV file selection (style.display bug, same cascade issue): - lh-ai-webdav-selected had inline style="display:flex" always visible - selectWebdavFile() / deselectWebdavFile() now use element.style.display - On select: browser div hides, selected indicator shows with file name + X - On deselect (X): indicator hides, browser shows again Topic context for Upload and Nextcloud tabs: - Both tabs now have optional "Topic / context" field - Sent to backend as 'topic' param to help AI focus the generated content Inline refine bar (replaces window.prompt): - Refine Body button shows/hides an amber inline input bar below generate buttons - Enter instructions, press Apply — no browser dialog, works in all contexts CSP: remove unsafe-inline from scriptSrc (security issue #2): - Converted all 26 onclick= handlers in component HTML files to data-action / data-target / data-label attributes - Added delegated click handler in app.js for copy/speak/nc-export actions - script-src now 'self' only; script-src-attr 'none' WebDAV path endpoint (security issue #5): - New POST /api/user/webdav-path (authMiddleware only, not moderator) - nextcloud.js updated to use new endpoint nodemailer: already at 6.10.1 (vulnerability fixed).	2026-03-24 02:28:43 -04:00
Daniel Onyejesi	0327afe94c	Fix quiz SQL bug, security hardening, componentize HTML, speed improvements - Fix: "missing FROM-clause entry for table q" in quiz submission query - Security: replace broken sanitizeHtml with allowlist-based sanitizer (prevents stored XSS) - Security: whitelist table names in uniqueSlug() to prevent SQL injection pattern - Security: replace raw err.message responses with generic errors in learning routes - Security: cap admin logs query LIMIT to 500 - Refactor: break 1685-line index.html into 12 lazy-loaded component files (280 lines shell) - Speed: add preconnect hints for Google Fonts and CDN - Speed: defer all script tags for faster initial paint - Speed: lazy-load tab HTML on activation (only active tab's DOM is parsed) - Update: replace HIPAA notice with institution-guidelines cautionary note	2026-03-23 20:01:54 -04:00

Author

SHA1

Message

Date

Daniel Onyejesi

7c7f72f54a

Fix WebDAV selection, pdf-parse, prompt(), CSP, security issues 1/2/4/5

pdf-parse (was v2, broken API):
- Downgraded to v1.1.1 — default export is a function again
- pdfParse is not a function error fixed

WebDAV file selection (style.display bug, same cascade issue):
- lh-ai-webdav-selected had inline style="display:flex" always visible
- selectWebdavFile() / deselectWebdavFile() now use element.style.display
- On select: browser div hides, selected indicator shows with file name + X
- On deselect (X): indicator hides, browser shows again

Topic context for Upload and Nextcloud tabs:
- Both tabs now have optional "Topic / context" field
- Sent to backend as 'topic' param to help AI focus the generated content

Inline refine bar (replaces window.prompt):
- Refine Body button shows/hides an amber inline input bar below generate buttons
- Enter instructions, press Apply — no browser dialog, works in all contexts

CSP: remove unsafe-inline from scriptSrc (security issue #2):
- Converted all 26 onclick= handlers in component HTML files to
  data-action / data-target / data-label attributes
- Added delegated click handler in app.js for copy/speak/nc-export actions
- script-src now 'self' only; script-src-attr 'none'

WebDAV path endpoint (security issue #5):
- New POST /api/user/webdav-path (authMiddleware only, not moderator)
- nextcloud.js updated to use new endpoint

nodemailer: already at 6.10.1 (vulnerability fixed).

2026-03-24 02:28:43 -04:00

Daniel Onyejesi

0327afe94c

Fix quiz SQL bug, security hardening, componentize HTML, speed improvements

- Fix: "missing FROM-clause entry for table q" in quiz submission query
- Security: replace broken sanitizeHtml with allowlist-based sanitizer (prevents stored XSS)
- Security: whitelist table names in uniqueSlug() to prevent SQL injection pattern
- Security: replace raw err.message responses with generic errors in learning routes
- Security: cap admin logs query LIMIT to 500
- Refactor: break 1685-line index.html into 12 lazy-loaded component files (280 lines shell)
- Speed: add preconnect hints for Google Fonts and CDN
- Speed: defer all script tags for faster initial paint
- Speed: lazy-load tab HTML on activation (only active tab's DOM is parsed)
- Update: replace HIPAA notice with institution-guidelines cautionary note

2026-03-23 20:01:54 -04:00

2 commits