Files
pc_builder/.gitignore
T
Kevin L'Hereec 3cc189c534 fix(security): close IDOR on computers/components update & destroy
- Scope update/destroy queries by userId (Computers & Components), matching
  the pattern already used in index/show/edit
- Add missing auth.authenticate() calls on destroy actions
- handleComponents now requires userId and scopes component lookups to the
  current user, preventing cross-user component takeover
- handleComponents rejects attaching more than one component of the same
  'unique' type to a computer (new InvalidComponentSelectionException, 422)
- handlePictures scopes picture lookups by computerId
- destroy(Computer) now detaches its components (computerId = null) instead
  of losing them to cascade delete, and removes the computer's uploads dir
- Switch store/update actions to request.validateUsing() for consistency
- Fix relative redirects to absolute paths (/computers, /computers/:id)
- Untrack .env.production and add it to .gitignore (secrets must not be
  committed); local file kept on disk
2026-07-23 10:53:13 +02:00

46 lines
491 B
Plaintext

# Dependencies and AdonisJS build
node_modules
build
tmp/*
!tmp/.gitkeep
dist
.output
# Secrets
.env
.env.local
.env.production
.env.production.local
.env.development.local
.env.test
# Frontend assets compiled code
public/assets
# Build tools specific
npm-debug.log
yarn-error.log
pnpm-debug.log
# Test coverage
coverage
# Editors specific
.fleet
.idea
.vscode
.serena
*.swp
*.swo
# Platform specific
.DS_Store
Thumbs.db
# IDE
*.sublime-project
*.sublime-workspace
# OS
.env.*.local