Security: Cloud-Auth auf Bearer-JWT umgestellt (IDOR-Luecke geschlossen)

Browse Source

- cloud_service: echter Login gegen baka-auth, Token statt X-API-Key/X-User
- app_config: hartcodierten API-Key-Default entfernt
- download_service + melo_logger: Bearer-Token statt X-API-Key
- navidrome: Passwort in flutter_secure_storage (Keychain/Keystore)
- song: token-haltige stream_url wird nicht mehr in SQLite persistiert
- cloud_screen: Pfad-Traversal beim Download-Dateinamen gefixt (p.basename)
- home_screen: Login-Dialog mit Passwort-Feld, Auto-Sync nutzt restoreLogin

...

This commit is contained in:

Hermes (Server)

2026-07-31 14:31:12 +02:00

parent 3e9389ab59

commit 9a880b0f21

17 changed files with 1552 additions and 181 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

android/build/reports/problems/problems-report.html

+1 -1

File diff suppressed because one or more lines are too long