curo1305andClaude Sonnet 4.6 23c27efd65 fix(06): CR-03 replace raw X-Forwarded-For reads with get_client_ip() ...

Replace all instances of request.headers.get("X-Forwarded-For") in
cloud.py (connect_webdav, delete_connection) and documents.py (upload,
confirm, delete) with get_client_ip(request) from deps.utils. Add
get_client_ip import to both files. Prevents XFF spoofing in audit logs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-04 23:15:48 +02:00

..

__init__.py

chore: initial commit — existing single-user document scanner codebase

2026-05-22 08:53:28 +02:00

admin.py

refactor(backend): extract shared helper modules per architecture rules

2026-06-02 16:10:35 +02:00

audit.py

fix(06.2): audit log — add email column, remove @ prefix from handles

2026-06-01 20:59:09 +02:00

auth.py

feat(06-05): trusted-proxy get_client_ip, per-account rate limiter, promote 8 xfail tests (D-11/D-12/D-13)

2026-06-04 18:27:49 +02:00

cloud.py

fix(06): CR-03 replace raw X-Forwarded-For reads with get_client_ip()

2026-06-04 23:15:48 +02:00

documents.py

fix(06): CR-03 replace raw X-Forwarded-For reads with get_client_ip()

2026-06-04 23:15:48 +02:00

folders.py

refactor(backend): extract shared helper modules per architecture rules

2026-06-02 16:10:35 +02:00

shares.py

refactor(backend): extract shared helper modules per architecture rules

2026-06-02 16:10:35 +02:00

topics.py

feat(phase-4): complete UX redesign — FileManagerView, FolderTreeItem, test suite, and all Phase 4 fixes

2026-05-28 17:10:52 +02:00