chore(release): public-release readiness and security fixes for 1.1.16

Browse Source

Security:
- Escape user-supplied values in LDAP filters and DNs (group_ldap.js, user_ldap.js)
- Replace Math.random() token/UUID/OTP generation with crypto.randomUUID / crypto.randomInt
- Refuse startup when oauth.jwtSecret is missing or placeholder

Fixes:
- Correct from-address template rendering in email.js

Packaging:
- Remove private flag and bump version to 1.1.16

Co-Authored-By: Claude <noreply@anthropic.com>

...

This commit is contained in:

William Mantly

2026-07-18 22:08:11 -04:00

parent 37f2ece172

commit efe3e514b0

9 changed files with 72 additions and 13 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

nodejs/routes/oauth.js

BIN

Binary file not shown.