En selvhostet webapp for å samle og dele favoritter — filmer, sanger, biler, lego, blomster, bilder, hva som helst. Én Go-binary, SQLite, HTMX. Enkel å drifte.
  • Go 82.2%
  • HTML 12.7%
  • JavaScript 2.5%
  • CSS 1.4%
  • Makefile 0.7%
  • Other 0.5%
Find a file
Ole-Morten Duesund 395b1b7523 fix: address security and quality issues from code review
Security fixes:
- Fix XSS in Atom feed: escape user-supplied URLs in HTML content
- Wrap signup request approval in a transaction to prevent
  partial state on crash (user created but request still pending)
- Stop leaking internal error messages to admin UI
- Add request body size limit on API import endpoint
- Log SetMustResetPassword errors instead of silently discarding

Correctness fixes:
- Handle errors from API fave update/delete instead of returning
  success on failure
- Use actual data timestamp for feed <updated> instead of
  time.Now() (improves HTTP caching)
- Replace hardcoded 10000 export limit with named constant
  (maxExportFaves = 100000)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-29 16:19:44 +02:00
cmd/favoritter feat: add JSON REST API under /api/v1/ 2026-03-29 16:13:23 +02:00
internal fix: address security and quality issues from code review 2026-03-29 16:19:44 +02:00
web feat: add Atom feeds and JSON/CSV import/export 2026-03-29 16:11:44 +02:00
.gitignore feat: implement Phase 1 (auth) and Phase 2 (faves CRUD) foundation 2026-03-29 15:55:22 +02:00
go.mod feat: add Atom feeds and JSON/CSV import/export 2026-03-29 16:11:44 +02:00
go.sum feat: add Atom feeds and JSON/CSV import/export 2026-03-29 16:11:44 +02:00
LICENSE feat: implement Phase 1 (auth) and Phase 2 (faves CRUD) foundation 2026-03-29 15:55:22 +02:00