curo1305andClaude Sonnet 4.6 3a6251ca23 fix(06): CR-04 add allowlist validation for default_storage_backend ...

Add _VALID_BACKENDS frozenset and validate body.backend before writing
to DB in PATCH /api/users/me/default-storage. Returns HTTP 422 for
any value not in the allowlist, preventing mass-assignment and logic
bypass via arbitrary string values.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-04 23:15:48 +02:00

..

__init__.py

chore: initial commit — existing single-user document scanner codebase

2026-05-22 08:53:28 +02:00

admin.py

refactor(backend): extract shared helper modules per architecture rules

2026-06-02 16:10:35 +02:00

audit.py

fix(06.2): audit log — add email column, remove @ prefix from handles

2026-06-01 20:59:09 +02:00

auth.py

feat(06-05): trusted-proxy get_client_ip, per-account rate limiter, promote 8 xfail tests (D-11/D-12/D-13)

2026-06-04 18:27:49 +02:00

cloud.py

fix(06): CR-04 add allowlist validation for default_storage_backend

2026-06-04 23:15:48 +02:00

documents.py

fix(06): CR-03 replace raw X-Forwarded-For reads with get_client_ip()

2026-06-04 23:15:48 +02:00

folders.py

refactor(backend): extract shared helper modules per architecture rules

2026-06-02 16:10:35 +02:00

shares.py

refactor(backend): extract shared helper modules per architecture rules

2026-06-02 16:10:35 +02:00

topics.py

feat(phase-4): complete UX redesign — FileManagerView, FolderTreeItem, test suite, and all Phase 4 fixes

2026-05-28 17:10:52 +02:00