ferdi2go

0 Followers · 0 Following

• Joined on 2026-02-27

Repositories

6

Projects Packages Public Activity Starred Repositories

ferdi2go closed issue ferdi2go/OnlyFrames#15 2026-05-27 12:32:37 +02:00

[Security] DOM-XSS via innerHTML mit User-Inputs (Dateinamen, Browse)

ferdi2go closed issue ferdi2go/OnlyFrames#14 2026-05-27 12:30:09 +02:00

[Security] IDOR: Job- und ZIP-IDs nicht an Session gebunden

ferdi2go commented on issue ferdi2go/OnlyFrames#14 2026-05-27 12:30:09 +02:00

[Security] IDOR: Job- und ZIP-IDs nicht an Session gebunden

Fix umgesetzt in server.py:

• Helper _request_token(request) extrahiert Bearer-Token (oder noauth bei deaktiviertem APP_PASSWORD)
• _check_owner(owner, request) -> 403 bei Mismatch -…

ferdi2go closed issue ferdi2go/OnlyFrames#13 2026-05-27 12:25:47 +02:00

[Security] Auth-Hardening: Timing-Attack, fehlendes Rate-Limit

ferdi2go commented on issue ferdi2go/OnlyFrames#13 2026-05-27 12:25:47 +02:00

[Security] Auth-Hardening: Timing-Attack, fehlendes Rate-Limit

Fix umgesetzt in server.py:

• secrets.compare_digest() fuer Passwort-Vergleich
• In-Memory-Rate-Limit: max. 5 Versuche/Minute pro IP, sonst HTTP 429

Manueller Test: 5 falsche Versuche -> 6.…

ferdi2go opened issue ferdi2go/OnlyFrames#25 2026-05-27 12:21:06 +02:00

[Quality] Logging-Infrastruktur + bare except eliminieren

ferdi2go opened issue ferdi2go/OnlyFrames#27 2026-05-27 12:21:06 +02:00

[Quality] HTTP-Status-Codes vereinheitlichen + Job-Dict typisieren

ferdi2go opened issue ferdi2go/OnlyFrames#26 2026-05-27 12:21:06 +02:00

[Quality] DRY: Tempdir-Validation und Extension-Listen zentralisieren

ferdi2go opened issue ferdi2go/OnlyFrames#21 2026-05-27 12:21:05 +02:00

[Bug] Silent Failures: AI ohne Key, HEIC ohne pillow-heif, Export-Skips

ferdi2go opened issue ferdi2go/OnlyFrames#16 2026-05-27 12:21:05 +02:00

[Security] /browse und /move ohne Pfad-Sandboxing

ferdi2go opened issue ferdi2go/OnlyFrames#15 2026-05-27 12:21:05 +02:00

[Security] DOM-XSS via innerHTML mit User-Inputs (Dateinamen, Browse)

ferdi2go opened issue ferdi2go/OnlyFrames#14 2026-05-27 12:21:05 +02:00

[Security] IDOR: Job- und ZIP-IDs nicht an Session gebunden

ferdi2go opened issue ferdi2go/OnlyFrames#24 2026-05-27 12:21:05 +02:00

[Perf/UX] Frontend: Polling-Backoff, Virtualisierung, Memo

ferdi2go opened issue ferdi2go/OnlyFrames#23 2026-05-27 12:21:05 +02:00

[Perf] Thumbnail-Endpoint + pHash/EXIF-Cache

ferdi2go opened issue ferdi2go/OnlyFrames#22 2026-05-27 12:21:05 +02:00

[Perf] Bilder werden 2-3x pro Bild dekodiert in analyze_folder

ferdi2go opened issue ferdi2go/OnlyFrames#20 2026-05-27 12:21:05 +02:00

[Bug] /download loescht Quelle auch bei fehlgeschlagenem ZIP-Schreiben

ferdi2go opened issue ferdi2go/OnlyFrames#17 2026-05-27 12:21:05 +02:00

[Security] CORS, Security-Header, Token-Speicherung

ferdi2go opened issue ferdi2go/OnlyFrames#18 2026-05-27 12:21:05 +02:00

[Bug] Pillow-Resource-Leak: Image.open() ohne with-Statement

ferdi2go opened issue ferdi2go/OnlyFrames#19 2026-05-27 12:21:05 +02:00

[Bug] Unbounded _jobs-Dict + Race in /export/download vs Cleanup

ferdi2go opened issue ferdi2go/OnlyFrames#13 2026-05-27 12:21:04 +02:00

[Security] Auth-Hardening: Timing-Attack, fehlendes Rate-Limit