Vito Sansevero
6c4c587d9e
fix(images): accept Show in folder only as a same-origin JSON request, one at a time
...
- require an Origin equal to the request's own scheme://host:port and,
when sent, Sec-Fetch-Site: same-origin; refuse every forwarding-style
header (Via, X-Forwarded-*, X-Original-*, *-Client-IP, CF-Connecting-IP
and the rest) as remote (security review M1, L2)
- answer a non-JSON body with 415, so a cross-origin request always needs
a CORS preflight (L2)
- single flight plus a 1 s cooldown per process: 429 code busy (L1)
- path resolution errors such as ENAMETOOLONG are a JSON 404, and neither
that nor a start failure logs the client's path at error level (L3)
2026-10-20 21:34:24 -07:00
..
2026-10-20 21:34:24 -07:00
2026-10-20 20:15:21 -07:00
2026-10-17 13:14:02 -07:00
2026-10-19 22:04:32 -07:00
2026-10-20 20:58:10 -07:00
2026-10-20 20:15:21 -07:00
2026-02-07 08:30:09 -08:00
2026-10-19 22:04:32 -07:00
2026-10-17 23:26:37 -07:00
2026-10-19 17:26:37 -07:00
2026-10-08 18:53:11 -07:00
2026-10-18 10:26:29 -07:00
2026-10-17 08:00:42 -07:00
2026-10-17 16:42:07 -07:00
2026-10-17 10:36:30 -07:00
2026-10-17 08:00:42 -07:00
2026-10-18 17:17:05 -07:00
2026-10-19 11:10:47 -07:00
2026-10-18 17:17:05 -07:00
2026-10-20 11:31:53 -07:00
2026-10-17 08:00:42 -07:00
2026-10-17 08:00:42 -07:00
2026-10-17 08:00:42 -07:00
2026-10-19 17:26:37 -07:00
2026-10-20 16:04:15 -07:00
2026-10-19 05:47:36 -07:00
2026-10-20 16:04:15 -07:00
2026-10-17 08:00:42 -07:00
2026-10-08 18:53:11 -07:00
2026-10-17 23:26:37 -07:00
2026-10-20 00:18:32 -07:00
2026-10-08 18:53:11 -07:00
2026-10-08 18:53:11 -07:00
2026-10-20 00:18:32 -07:00
2026-10-19 11:10:47 -07:00
2026-10-18 20:03:15 -07:00
2026-10-20 11:31:53 -07:00
2026-10-17 16:42:07 -07:00
2026-10-08 18:53:11 -07:00
2026-10-08 18:53:11 -07:00
2026-10-17 23:26:37 -07:00
2026-10-17 23:26:37 -07:00
2026-10-19 11:10:47 -07:00
2026-10-17 19:51:22 -07:00
2026-10-17 19:51:22 -07:00
2026-10-17 23:26:37 -07:00
2026-10-17 19:51:22 -07:00
2026-10-19 11:10:47 -07:00
2026-10-17 16:42:07 -07:00
2026-10-17 23:26:37 -07:00
2026-10-18 20:03:15 -07:00
2026-10-17 23:26:37 -07:00
2026-10-17 23:26:37 -07:00
2026-10-19 11:10:47 -07:00
2026-10-17 23:26:37 -07:00
2026-10-17 23:26:37 -07:00
2026-10-17 23:26:37 -07:00
2026-10-20 18:01:34 -07:00
2026-10-17 23:26:37 -07:00
2026-10-17 16:42:07 -07:00
2026-10-17 05:31:24 -07:00
2026-10-17 08:00:42 -07:00
2026-10-19 20:56:51 -07:00
2026-10-19 20:56:51 -07:00
2026-10-19 22:04:32 -07:00
2026-10-08 18:53:11 -07:00
2026-10-19 17:26:37 -07:00
2026-10-18 17:17:05 -07:00
2026-10-18 17:17:05 -07:00
2026-10-17 23:26:37 -07:00
2026-10-20 00:18:32 -07:00
2026-10-08 18:53:11 -07:00
2026-10-08 18:53:11 -07:00
2026-10-20 21:34:24 -07:00
2026-10-19 20:56:51 -07:00
2026-10-17 16:42:07 -07:00
2026-10-19 09:54:29 -07:00
2026-10-19 17:26:37 -07:00
2026-10-19 17:26:37 -07:00
2026-10-19 09:54:29 -07:00
2026-10-19 09:54:29 -07:00
2026-10-19 09:54:29 -07:00
2026-10-19 17:26:37 -07:00
2026-10-18 20:03:15 -07:00
2026-10-20 00:18:32 -07:00
2026-10-08 18:53:11 -07:00
2026-10-08 18:53:11 -07:00
2026-02-07 12:36:11 -08:00
2026-10-08 18:53:11 -07:00
2026-10-07 13:52:09 -07:00
2026-10-17 08:00:42 -07:00
2026-10-08 18:53:11 -07:00
2026-10-17 08:00:42 -07:00
2026-10-17 19:51:22 -07:00
2026-10-17 08:00:42 -07:00
2026-10-17 08:00:42 -07:00
2026-10-17 08:00:42 -07:00
2026-10-17 08:00:42 -07:00
2026-10-19 20:56:51 -07:00
2026-10-18 20:03:15 -07:00
2026-10-19 05:47:36 -07:00
2026-10-17 08:00:42 -07:00
2026-10-17 08:00:42 -07:00
2026-10-08 18:53:11 -07:00
2026-10-17 06:47:46 -07:00
2026-10-17 19:51:22 -07:00
2026-10-19 17:26:37 -07:00
2026-10-18 20:03:15 -07:00
2026-04-10 12:49:59 -07:00
2026-10-08 18:53:11 -07:00
2026-10-17 16:42:07 -07:00
2026-10-08 18:53:11 -07:00
2026-10-08 18:53:11 -07:00
2026-10-08 18:53:11 -07:00
2026-10-17 06:47:46 -07:00
2026-10-17 16:42:07 -07:00
2026-10-08 18:53:11 -07:00
2026-10-18 10:01:19 -07:00
2026-10-08 18:53:11 -07:00
2026-10-08 18:53:11 -07:00
2026-10-08 18:53:11 -07:00
2026-10-19 05:47:36 -07:00
2026-10-19 23:04:40 -07:00