jubnl 82cce365f7 fix: validate image-only uploads and respect allowed_file_types setting for journey photos ...

Add fileFilter to the journey photo multer config (shared by entry photo
upload and gallery upload routes):
- Rejects any non-image MIME type (including SVG which carries XSS risk)
- Checks the extension against the admin-configured allowed_file_types setting
  (same getAllowedExtensions() used by the trip file upload route)
- Returns HTTP 400 with a descriptive message on rejection

Also fix the global error handler to return err.message for 4xx responses
instead of the generic 'Internal server error', so fileFilter rejections
produce a readable error on the client.

2026-04-22 16:16:35 +02:00

..

memories

fix journey bugs reported by roel-de-vries (#722-#736)

2026-04-18 19:11:16 +02:00

admin.ts

fix(mcp): add RFC 9728 PRM, RFC 8707 audience binding, and collab sub-feature gating

2026-04-20 07:34:38 +02:00

airports.ts

feat(bookings): show transport routes on map (#384, #587)

2026-04-17 14:04:40 +02:00

assignments.ts

Fix map tooltips, journey creation, and contributor avatars

2026-04-12 23:20:13 +02:00

atlas.ts

feat(atlas): mark sub-national regions as visited with cascade behavior

2026-04-05 03:17:59 +02:00

auth.ts

security: internal audit — batch 1

2026-04-20 20:36:52 +02:00

backup.ts

refactor: extract business logic from routes into reusable service modules

2026-04-02 17:14:53 +02:00

budget.ts

feat: drag-and-drop reorder for budget categories and items (#479)

2026-04-09 19:21:43 +02:00

categories.ts

refactor: extract business logic from routes into reusable service modules

2026-04-02 17:14:53 +02:00

collab.ts

security: internal audit — batch 1

2026-04-20 20:36:52 +02:00

dayNotes.ts

refactor: extract business logic from routes into reusable service modules

2026-04-02 17:14:53 +02:00

days.ts

feat: support check-in time ranges for hotel accommodations

2026-04-16 00:23:00 +02:00

files.ts

fix(backups,files): auto-backups rejected by validator; trip file download broken after cookie migration

2026-04-21 11:18:17 +02:00

journey.ts

fix: validate image-only uploads and respect allowed_file_types setting for journey photos

2026-04-22 16:16:35 +02:00

journeyPublic.ts

feat: unified photo provider abstraction layer (#584)

2026-04-13 20:08:31 +02:00

maps.ts

feat(maps): add kill switches for Google Places autocomplete and details

2026-04-17 19:28:40 +02:00

notifications.ts

feat(notifications): add ntfy as a first-class notification channel

2026-04-15 13:59:25 +02:00

oauth.ts

security: address silent-failure review findings on top of batch 1

2026-04-20 20:44:57 +02:00

oidc.ts

security: close SEC-H4/H6 gaps from second-pass review

2026-04-20 21:35:30 +02:00

packing.ts

feat(packing): item quantity, bag rename, multi-user bags, save as template

2026-04-05 19:28:33 +02:00

photos.ts

feat: unified photo provider abstraction layer (#584)

2026-04-13 20:08:31 +02:00

places.ts

feat(import): selective GPX/KML element import and performance improvements

2026-04-18 01:28:37 +02:00

publicConfig.ts

fix(login): address review feedback on language dropdown PR

2026-04-15 03:04:25 +02:00

reservations.ts

feat: add multi-day transport reservations with dedicated modal and route segmentation

2026-04-18 06:10:33 +02:00

settings.ts

feat(security): mask saved webhook URLs instead of returning encrypted values

2026-04-05 06:08:44 +02:00

share.ts

refactor: extract business logic from routes into reusable service modules

2026-04-02 17:14:53 +02:00

systemNotices.ts

feat(notices): add system notice infrastructure

2026-04-16 14:36:33 +02:00

tags.ts

refactor: extract business logic from routes into reusable service modules

2026-04-02 17:14:53 +02:00

todo.ts

feat(todo): add To-Do list feature with 3-column layout

2026-04-04 16:58:24 +02:00

trips.ts

fix(offline): cache accommodations, trip members, tags, and categories for full offline support

2026-04-14 23:50:52 +02:00

vacay.ts

refactor: extract business logic from routes into reusable service modules

2026-04-02 17:14:53 +02:00

weather.ts

refactor: extract business logic from routes into reusable service modules

2026-04-02 17:14:53 +02:00