dtoro 312a4c1ee4 feat(sidecar): extend scoped proxy to web-client mutations, harden path classification ...

Batch archive/restore/delete/approve/private validate every UID against
the PhotoPrism DB in one query. Per-photo PUT/approve/like/stack-file
ops are ownership-checked. Admin-role sessions pass through fully so
settings/users/index dialogs keep working. Paths are unescaped+cleaned
before classification so encoded dot-segments can't smuggle past the
allowlist. Full httptest coverage of the routing decisions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-03 13:05:12 +02:00

12 KiB

Raw Blame History

View Raw