jpmschweitzer/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-10-09 00:12:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): enforce registered endpoint authority

Browse Source 
Require caller-supplied model endpoints to resolve through enabled owner-visible registrations, harden session path encoding, and remove the SVG title HTML parsing sink.
This commit is contained in:
Alexandre Teixeira
2026-10-05 22:24:15 +01:00
parent 481726acf2
commit 9ee614e2ac
9 changed files with 349 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
static/js/sessions.js
+1 -1
View File
@@ -435,7 +435,7 @@ function getFolderNames() {
async function moveToFolder(sessionId, folderName) {
const fd = new FormData();
fd.append('folder', folderName || '');
await fetch(`${API_BASE}/api/session/${sessionId}`, { method: 'PATCH', body: fd });
await fetch(`${API_BASE}/api/session/${encodeURIComponent(sessionId)}`, { method: 'PATCH', body: fd });
// Update local data
const s = sessions.find(x => x.id === sessionId);
if (s) s.folder = folderName || null;