Michael/FlowReader
1
0 Fork 0
mirror of https://github.com/R0m1k3/FlowReader.git synced 2026-10-11 17:28:05 +02:00
Code Issues Packages Projects Releases Wiki Activity
101 Commits 7 Branches 0 Tags
redesign/webui
Commit Graph
16 Commits
Author SHA1 Message Date
MichaelandClaude Opus 4.8 3402e53954 sécurité : correctifs XSS, SSRF, CSWSH, rate-limit et durcissement 
- XSS stocké (critique) : sanitisation bluemonday sur tous les endpoints
  d'articles (List, ListByFeed, Favorites, Search, Get), pas seulement Get
- SSRF (élevé) : nouveau utils/safehttp.go (ValidateExternalURL + client durci
  via Dialer.Control, bloque IP privées/loopback/link-local/metadata,
  anti-DNS-rebinding et limite de redirections) appliqué à l'extracteur et au parser
- WebSocket CSWSH (élevé) : politique same-origin + override WS_ALLOWED_ORIGINS
- rate-limiting (moyen) : token-bucket en mémoire sur /auth/*
- token de session retiré du corps JSON (json:"-"), livré uniquement par le
  cookie HttpOnly
- cookie Secure correct derrière un reverse-proxy (X-Forwarded-Proto +
  override COOKIE_SECURE)
- admin : interdiction de supprimer son propre compte
- en-têtes de sécurité (nosniff, X-Frame-Options, Referrer-Policy,
  Permissions-Policy)

Note : backend non compilé localement (pas de toolchain Go) ; à valider via Docker.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-11 13:21:43 +02:00
Michael c4cc7eaf87 feat: auto-cleanup articles > 30d and relocate AI summary to reader view 2026-02-09 11:49:54 +01:00
Michael 5b219cf0e7 feat(ia): implement Smart Digest and fix UI alignment 2026-02-09 10:06:13 +01:00
Michael 7e802df2a7 feat: implement Deep Forest dark mode, swipe gestures, PWA support, and PostgreSQL Full-Text Search 2026-02-09 09:18:40 +01:00
Antigravity Agent fd03cdfd34 feat(feeds): implement rename feed functionality and ui 2026-02-04 22:22:57 +01:00
Michael 007aec2094 fix: add immediate feed fetch, refresh api and frontend update button 2026-02-04 16:40:04 +01:00
Michael 502b76c5d6 fix(backend): solve 500 errors with auto-migrations and standardized filenames 2026-02-04 16:32:28 +01:00
Michael 8777d3b970 feat(epic-4): synchro multi-appareils, outils d'admin et optimisations performance 2026-02-04 15:17:59 +01:00
Michael dc26f22f51 feat(epic-3): implémentation du Dashboard, mode lecture et notifications temps réel 2026-02-04 15:12:54 +01:00
Michael 1d31de95ec feat(story-2.4-2.5): add article handler, background fetcher worker 2026-02-04 15:01:36 +01:00
Michael 20589ee55b feat(story-2.3): add OPML import/export functionality 2026-02-04 14:58:30 +01:00
Michael 1249e1bd42 feat(story-2.1): add feed model and add-feed-by-url API 2026-02-04 14:52:40 +01:00
Michael d67e169a43 feat(story-1.4): add session-based authentication with login/logout 2026-02-04 14:44:48 +01:00
Michael e186a4dd87 feat(story-1.3): add user registration API with Argon2 password hashing 2026-02-04 14:41:42 +01:00
Michael caa1d885b6 feat(story-1.2): add database migration system with golang-migrate 2026-02-04 14:39:44 +01:00
Michael 99f1300e13 feat(story-1.1): implement walking skeleton with Go Chi and Docker Compose 2026-02-04 14:33:38 +01:00