dev
6844d659fc
- require ADMIN_PASSWORD (no default), remove CORS - close public DB port, move DB credentials to .env (DB_PASSWORD) - fix HTML escaping, add helmet + sec headers (no CSP due to inline scripts) - rate limit public routes by IP (express-rate-limit) - validate restore data and confine file unlinking to uploads/ - block dangerous upload extensions, 30MB per-entry limit, SVG not served inline - return 400 on unknown group_id in POST /api/entries - add commented Caddy/Let's Encrypt reverse-proxy scaffold + Caddyfile.example - update README
17 lines
298 B
JSON
17 lines
298 B
JSON
{
|
|
"name": "whereldo",
|
|
"version": "1.0.0",
|
|
"private": true,
|
|
"scripts": {
|
|
"start": "node server.js"
|
|
},
|
|
"dependencies": {
|
|
"express": "^4.21.0",
|
|
"express-rate-limit": "^8.7.0",
|
|
"helmet": "^8.3.0",
|
|
"multer": "^1.4.5-lts.1",
|
|
"pg": "^8.13.0",
|
|
"tar": "^7.4.3"
|
|
}
|
|
}
|