bd8e413bc7
Some checks failed
Forgejo Android APK / Root app tests (push) Successful in 59s
Forgejo Docker Build / Root app tests (push) Successful in 50s
Forgejo Android APK / Build signed APK (push) Successful in 1m56s
Forgejo Docker Build / Build Docker image (push) Successful in 9s
Forgejo Docker Build / Deploy to the host (push) Failing after 0s
The MIME type was taken on trust here. Anything at all could be posted as image/png: it passed the size and base64 checks, was stored in the saved chat, and was handed to a provider as a data URI. Documents and S3 uploads have always been sniffed by fileType.js; this was the one upload path that was not. Now sniffed with the same helper, so there is one idea of what a PNG looks like. A PHP payload, a shell script, an ELF or PE binary, a zip, or a real PDF labelled image/png are all refused with a message that says what is wrong. What this does not claim: bytes hidden after a valid PNG header still make a valid PNG, and no sniffer can promise otherwise. The protection is that the file is never executed and never served as anything but an image. Existing fixtures used buffers of 0x07 as stand-in images, which are correctly refused now. They carry real file headers instead — a fixture should be the thing it claims to be, exactly like a real upload. Also adds the deck theme system: five palettes in assets/deck-themes.json, render_pptx.py rebinding its palette from the theme rather than hardcoding it, the theme carried on the deck and validated against the same catalogue the renderer reads, a picker on the generate form, and PUT /my-resources/:id/theme to re-skin a stored deck with no model call. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU |
||
|---|---|---|
| .. | ||
| admin | ||
| assistant | ||
| bedside | ||
| calculators | ||
| learningHub | ||
| notes | ||
| wellVisit | ||
| accountBoundary.js | ||
| admin-docs.js | ||
| admin.js | ||
| app.js | ||
| audioBackup.js | ||
| auth.js | ||
| authFetch.js | ||
| calc-math.js | ||
| calculators.js | ||
| chartReview.js | ||
| clinicalAssistant.js | ||
| diagrams.js | ||
| documents.js | ||
| drugs-loader.js | ||
| e2e-bootstrap.js | ||
| ed-encounters.js | ||
| encounters.js | ||
| extensions.js | ||
| generatedImages.js | ||
| hospitalCourse.js | ||
| learningHub.js | ||
| liveEncounter.js | ||
| memories.js | ||
| milestones.js | ||
| milestonesData.js | ||
| myResources.js | ||
| nextcloud.js | ||
| notes.js | ||
| peGuide.js | ||
| recordingModules.js | ||
| secureStorage.js | ||
| shadess.js | ||
| sickVisit.js | ||
| soap.js | ||
| speechRecognition.js | ||
| transcriptionSettings.js | ||
| ui-state.js | ||
| voiceDictation.js | ||
| voicePreferences.js | ||
| wellVisit.js | ||